AI browsers are being marketed as the next big leap in web technology, promising to summarize pages, book travel, and even make purchases on your behalf. But a new study from the University of Washington has uncovered a troubling reality: the more capable these browsers become, the bigger the security risk they pose. Researchers found that four out of seven popular AI browsers contain vulnerabilities serious enough to allow malicious websites to steal data from other sites a user has open in different tabs. The findings raise critical questions about the trade-off between convenience and security in the rapidly evolving landscape of AI-powered browsing.

The 30-Year Security Rule That AI Browsers Are Breaking

Since 1995, every major web browser has adhered to a foundational security principle known as the same-origin policy. This rule prevents websites from accessing data from another site, ensuring that if a user has their bank account open in one tab and a questionable site in another, the latter cannot read sensitive financial information. The policy has been a cornerstone of web security, protecting users from cross-site data theft for nearly three decades.

AI browsers, however, require the ability to read and interact with multiple tabs simultaneously to perform their advanced tasks. For example, an AI agent might need to retrieve flight details from one tab and compare prices from another, or automatically fill in a booking form using information stored across different sites. This necessity forces AI browsers to bypass the same-origin policy, granting them broader access to user data across tabs. And as the University of Washington study demonstrates, that broader access is precisely what attackers can exploit.

Two Attack Methods: Prompt Injection and Memory Poisoning

The study identifies two primary methods through which malicious actors can compromise AI browsers. The first is prompt injection, where a malicious webpage hides secret instructions within its content. The AI agent, designed to follow commands from webpages to perform tasks, unwittingly executes these hidden instructions without realizing it has been manipulated. This could potentially expose private emails, passwords, or calendar details. Attackers can embed these instructions in seemingly harmless pop-ups, forms, or even text that is invisible to human users but readable by the browser's AI component.

The second method, memory poisoning, is even more insidious. Here, planted instructions are stored in the AI agent's long-term memory and activate later, even after the original malicious page has been closed. For instance, an attacker could embed a command that tells the AI to send all future browsing data to a remote server every time the user accesses a banking website. The researchers successfully executed a proof-of-concept attack on ChatGPT Atlas, demonstrating that the risk is not theoretical but very real.

The study notes that Claude for Chrome was flagged as particularly risky due to its browser extension design, which allows it to inject code directly into webpages. This level of access makes it easier for malicious instructions to be carried out without detection.

Which AI Browsers Are Safe and Which Put Your Data at Risk?

The researchers evaluated seven AI browsers: ChatGPT Atlas, Chrome with Gemini (Google's AI assistant), Claude for Chrome, Perplexity Comet, Microsoft Edge with Copilot, Brave Leo, and Firefox AI Mode. Of these, the first four were found to be vulnerable to the attacks described. In contrast, Microsoft Edge with Copilot, Brave Leo, and Firefox AI Mode showed stronger security properties, though it is worth noting that Firefox was also the most limited in terms of AI capabilities, which could partially explain its better security posture.

The researchers disclosed their findings to all six companies involved (ChatGPT Atlas is an OpenAI product, Chrome with Gemini is Google, Claude for Chrome is Anthropic, Perplexity Comet is Perplexity AI, Edge with Copilot is Microsoft, Brave Leo is Brave, and Firefox AI Mode is Mozilla). The responses varied significantly. Anthropic (Claude) and Mozilla (Firefox) did not respond to the findings. Perplexity AI and OpenAI declined to take action, arguing that the researchers lacked a complete end-to-end demonstration of a real-world attack. Google, Microsoft, and Brave, however, engaged constructively with the study, indicating a willingness to address the vulnerabilities.

Broader Implications and Previous Exploits

This study follows the recent BioShocking exploit, which demonstrated how AI browsers can be manipulated by context. In that case, researchers were able to trick an AI agent into performing unintended actions by carefully crafting the environment of a webpage. Together, these findings suggest that the race to deliver AI-powered browsing features may be outpacing the security measures needed to protect users.

The fundamental issue lies in the architectural design of these AI agents. To provide the promised convenience—such as automatic form filling, cross-tab data aggregation, and proactive recommendations—they must have access to a wide range of user data. This creates a lucrative target for attackers. Moreover, the use of machine learning models that interpret natural language instructions makes them susceptible to adversarial input, a problem that has plagued AI systems in other domains as well.

From a historical perspective, the same-origin policy was established after a series of cross-site scripting attacks in the early days of the web. It has remained effective because browsers strictly enforced isolation between different origins. AI browsers, however, were developed by extending existing browser frameworks, and in doing so, they often weakened or bypassed this isolation. The security community had warned that such an approach could lead to problems, and the University of Washington study confirms those fears.

For users, the immediate takeaway is that caution is warranted when using AI browser extensions or built-in AI features. While the convenience of having a digital assistant manage online tasks is appealing, the risks may be significant, especially for those who access sensitive financial, medical, or personal accounts through their browsers. The researchers recommend that users consider using separate browsers or profiles for high-security tasks, or at least disable AI features when visiting untrusted sites.

The study also underscores the need for clearer regulatory guidelines and industry standards for AI-powered browsing tools. As of now, there is no universal framework for evaluating the security of these products, and companies are largely self-regulating. The varied responses from the affected companies—some engaging constructively, others dismissing the findings—highlight the inconsistent approach to security across the industry.

Looking ahead, the development of AI browsers will likely continue, as both companies and users see immense value in their capabilities. However, this study serves as a critical reminder that with great power comes great responsibility. Future iterations of these tools must incorporate robust security measures from the ground up, rather than retrofitting patches after vulnerabilities are exposed. Until then, users should remain vigilant and not take the advertised convenience of AI browsers at face value without considering the potential costs to their privacy and security.

Source:Digital Trends News