Artificial Intelligence (AI) browsers are gaining traction, which means we may need to start worrying about the potential dangers of something called \u201cprompt injection.\u201d<\/p>\n
Large language models (LLMs)\u2014like the ones that power AI chatbots including ChatGPT, Claude, and Gemini\u2014are designed to follow \u201cprompts,\u201d which are the instructions and questions that people provide when looking up info or getting help with a topic. In a chatbot, the questions you ask the AI are the \u201cprompts.\u201d But AI models aren\u2019t great at telling apart the types of commands that are meant for their eyes only (for example, hidden background rules that come directly from developers, like \u201cdon\u2019t write ransomware<\/a>\u201c) from the types of requests that come from users.<\/p>\n To showcase the risks here, the web browser developer Brave\u2014which has its own AI assistant called Leo\u2014recently tested whether it could trick an AI browser into reading dangerous prompts that harm users. And what the company found caused alarm, as they wrote in a blog this week<\/a>:<\/p>\n \u201cAs users grow comfortable with AI browsers and begin trusting them with sensitive data in logged in sessions\u2014such as banking, healthcare, and other critical websites\u2014the risks multiply. What if the model hallucinates and performs actions you didn\u2019t request? Or worse, what if a benign-looking website or a comment left on a social media site could steal your login credentials or other sensitive data by adding invisible instructions for the AI assistant?\u201d<\/p>\n Prompt injection, then, is basically a trick where someone inserts carefully crafted input in the form of an ordinary conversation or data, to nudge or outright force an AI into doing something it wasn\u2019t meant to do.<\/p>\n What sets prompt injection apart from old-school hacking is that the weapon here is language, not code. Attackers don\u2019t need to break into servers or look for traditional software bugs, they just need to be clever with words.<\/p>\n For an AI browser, part of the input is the content of the sites it visits. So, it\u2019s possible to hide indirect prompt injections inside web pages by embedding malicious instructions in content that appears harmless or invisible to human users but is processed by AI browsers as part of their command context.<\/p>\n Now we need to define the difference between an AI browser and an agentic browser. An AI browser is any browser that uses artificial intelligence to assist users. This might mean answering questions, summarizing articles, making recommendations, or helping with searches. These tools support the user but usually need some manual guidance and still rely on the user to approve or complete tasks.<\/p>\n But, more recently, we are seeing the rise of agentic browsers, which are a new type of web browser powered by artificial intelligence, designed to do much more than just display websites. These browsers are designed to actually take over entire workflows, executing complex multi-step tasks with little or no user intervention, meaning they can actually use and interact with sites to carry out tasks for the user, almost like having an online assistant. Instead of waiting for clicks and manual instructions, agentic browsers can navigate web pages, fill out forms, make purchases, or book appointments on their own, based on what the user wants to accomplish.<\/p>\n For example, when you tell your agentic browser, \u201cFind the cheapest flight to Paris next month and book it,\u201d the browser will do all the research, compare prices, fill out passenger details, and complete the booking without any extra steps or manual effort\u2014provided it has all the necessary details of course, which are part of the prompts the user feeds the agentic browser.<\/p>\n Are you seeing the potential dangers of prompt injections here?<\/p>\n What if my agentic browser gets new details while visiting a website? I can imagine criminals setting up a website with extremely competitive pricing just to attract visitors, but the real goal is to extract the payment information which the agentic browser needs to make purchases on your behalf. You could end up paying for someone else\u2019s vacation to France.<\/p>\n During their research, Brave found that Perplexity\u2019s Comet has some vulnerabilities which \u201cunderline the security challenges faced by agentic AI implementations in browsers.\u201d<\/p>\n The vulnerabilities allow an attack based on indirect prompt injection, which means the malicious instructions are embedded in external content (like a website, or a PDF) that the browser AI assistant processes as part of fulfilling the user\u2019s request. There are various ways of hiding that malicious content from a casual inspection. Brave uses the example of white text on a white background which AI browsers have no problem reading and a human would not see without closer inspection.<\/p>\n