NEW YORK — What happened: Security researchers demonstrated how stateful browser agents navigating the live internet are vulnerable to malicious instructions embedded in CSS text, hidden alt tags, and user comments.
Why it matters: As enterprises deploy agents to book travel, manage customer support tickets, and execute e-commerce purchases, web scraping and navigation agents become prime targets for indirect prompt injection attacks.
Deep dive: Unlike traditional web scrapers that parse raw HTML, stateful browser agents render pages, read visual elements, and execute DOM manipulations. When an agent encounters malicious text instructing it to exfiltrate session tokens or purchase unauthorized items, it often lacks the contextual awareness to distinguish legitimate instructions from injected exploits.
Report check (claims vs what is verified vs still rumor): Cybersecurity firms verified successful data exfiltrations across multiple popular browser-use architectures. Rumors that major browser vendors have patched this at the kernel level remain unconfirmed.
Open questions: What new browser primitives are required to give autonomous agents a secure, restricted 'view' of the web that strips out hidden adversarial text?