The Web Was Built to Keep Websites Apart. AI Agents Are Breaking That Wall

For most people, the web feels like one continuous place. Gmail sits in one tab, a bank in another, a shopping site in a third. Underneath that familiar surface, however, the browser treats those sites as mutually suspicious strangers.

That separation is one of the quiet engineering achievements that made the modern web possible. Now AI browser agents are challenging it. To book a trip, compare products or organise a working day, an agent may need to read one website, carry information into another, click buttons, fill forms and operate through accounts that are already logged in. In other words, its usefulness comes from crossing boundaries the browser spent decades building.

This is not simply another story about a chatbot making a mistake. It is a deeper collision between two different security models: a web designed around isolated origins, and an AI designed to assemble context and act across them.

The invisible wall protecting every browser tab

The web's foundational barrier is called the same-origin policy. An origin is broadly defined by a page's protocol, hostname and port. A script running on one origin is normally prevented from reading or manipulating sensitive content belonging to another.

If an attacker persuades you to open a malicious page while your email or bank is open elsewhere, that page should not be able to read your inbox, inspect your balance or retrieve stored cookies. Related protections, including site isolation and browser sandboxes, reinforce the wall.

The boundary is not perfect, and websites can deliberately permit certain forms of cross-origin communication. But the default assumption is clear: content from one site does not automatically earn access to another simply because both appear in the same browser.

Why an agent changes the equation

A browser agent is not ordinary page code. It may receive a representation of several pages, understand natural-language instructions, navigate between sites and use the browser much as a human would. Some implementations can click, type, run scripts or interact through extensions. They may also inherit the user's authenticated sessions.

That creates an unusually powerful bridge. A person might ask, “Summarise this page and add the recommended products to my cart.” The agent must interpret untrusted web content, decide what the user meant, gather information and take actions elsewhere. If malicious text on the page is mistaken for an instruction, the bridge can be turned against the user.

This attack is known as indirect prompt injection. The hostile instruction does not need to arrive in the user's message. It can hide in a webpage, an advertisement, a document, a review or content loaded inside an embedded frame. The AI reads it as data, but may follow it as a command.

A proof of concept that crosses the wall

Researchers Franziska Roesner and David Kohlbrenner at the University of Washington examined seven agentic browser systems. Their tests, conducted in early 2026, found widely different decisions about what agents were allowed to see and do.

In the least restrictive designs, the researchers found that a successful prompt injection could use the agent to circumvent the same-origin policy. Their full proof of concept against ChatGPT Atlas in Agent Mode placed malicious instructions on one page, caused the agent to include information from a cross-origin frame in a summary, and sent that combined text back through a form controlled by the attacker.

The team also reported that Chrome with Gemini, Claude for Chrome and Perplexity Comet met important preconditions for cross-origin attacks if prompt injection succeeded. It identified further risks including cross-origin action forgery, access to masked input and poisoning of an agent's chat memory.

There are important limits. The demonstrated attack required particular framing and cookie conditions, the experiments were a snapshot of products in early 2026, and a precondition is not the same as a successful exploit. Vendors can change architecture quickly. The study nevertheless exposes the central problem: in some designs, the strength of a browser's origin boundary can effectively fall to the strength of an AI model's ability to reject a malicious instruction.

The browser extension problem

Separate research from Manifold Security illustrates why implementation details matter. The company reported that Claude for Chrome could be pushed by another browser extension into workflows capable of reading Gmail or opening Google Docs, and that a URL parameter could suppress permission prompts in certain flows. Manifold said it reproduced the issues after earlier disclosures to Anthropic.

Those findings should be read as the researchers' documented claims about specific versions and configurations, not proof that every Claude session or AI browser is compromised. They also point to an architectural lesson: an AI model is only one component. Extension privileges, workflow handlers, permission prompts and browser APIs determine what a manipulated model can actually do.

A brilliant model inside an over-permissioned extension can still become a dangerous deputy.

Why “just stop prompt injection” is not enough

Prompt injection remains an open security problem because language models are built to interpret language. The same flexibility that lets an agent understand an unusual instruction also makes it hard to separate trusted commands from hostile content with absolute reliability.

OWASP lists prompt injection, sensitive-information disclosure and excessive agency among the major risks for applications built around large language models. Better training, filters and attack detectors help, but they are probabilistic defenses. A sufficiently consequential action should not depend on the model making the right judgement every time.

Traditional security engineering therefore asks a different question: if the intelligent component is confused, what is it still physically allowed to access and change?

Google's answer: give every task an origin set

Google has described a layered design for agentic Chrome features. It includes a separate “User Alignment Critic” that reviews proposed actions without seeing raw untrusted page content, prompt-injection detection, confirmations for sensitive operations and task-specific origin sets.

Under this model, the browser tracks origins the agent may only read and origins on which it may also act. Content from unrelated frames can be withheld from the model entirely. New origins must pass a gating decision before being added. Purchases, payments, messages and visits to sensitive sites can trigger confirmation or require the user to take over.

This approach is significant because it moves part of the defence out of the model and into enforceable browser architecture. Google also acknowledges that the balance is difficult: tight gates reduce risk but can make the agent frustrating; broad access makes it useful but increases the blast radius when something goes wrong.

The real prize is the authenticated web

The excitement around agentic browsers is not only about convenience. The browser contains one of the richest concentrations of a person's digital authority: active accounts, email, calendars, cloud documents, saved addresses, work systems, shopping profiles and sometimes payment access.

An agent that can operate there becomes a universal interface for services that were never designed to cooperate. It could compare insurance policies, move information between enterprise tools, assemble travel plans or complete repetitive administrative work. That same reach is why the browser may become the most consequential battlefield for consumer AI security.

The winning product will not necessarily be the agent that clicks the most sites with the least friction. It may be the one that can prove why each site, piece of data and action belongs to the task.

What safer agentic browsing should look like

• Least privilege by task: Give an agent access only to the sites and actions required for the current job, then revoke it.
• Origin-aware data flow: Preserve where information came from and prevent sensitive data from flowing into an unrelated destination.
• Non-bypassable confirmation: Payments, account changes, messages, downloads and data exports should pause at a browser-enforced checkpoint.
• Separate trusted and untrusted reasoning: A security reviewer should not consume the same hostile content that may have confused the planning model.
• Visible logs: Users and enterprise administrators need a readable record of what the agent saw, attempted and changed.
• Disposable memory: Task memory should expire, and content from an untrusted page should not silently influence future sessions.

What users can do today

People testing browser agents should avoid granting broad access to a profile used for banking, health records or administrative work. A separate browser profile, limited extensions and explicit confirmation for every consequential action reduce exposure. Auto-execution should remain off where possible, and unexpected instructions or requests to move data between sites should be treated as warning signs.

Businesses should evaluate browser agents as privileged software, not as ordinary chat tools. That means inventorying permissions, restricting sensitive domains, logging actions, testing prompt-injection scenarios and defining which decisions always require a human.

The wall does not need to disappear

AI agents can make the web dramatically more useful. They can connect fragmented services without waiting for every company to build a perfect integration. But the industry's challenge is to let agents cross boundaries intentionally without erasing those boundaries altogether.

The web learned, through decades of attacks, that convenience is not a substitute for isolation. Agentic browsing is now relearning that lesson at machine speed. The future belongs not to an AI that can go everywhere, but to one whose freedom is narrow, visible and revocable.