In April 2026, a team of University of Washington researchers stood before a roomful of security experts in Rio de Janeiro and delivered a diagnosis that should unsettle anyone who has handed their browsing over to an AI assistant. The problem is not a bug. There is no patch coming. The tension runs straight through the architecture of every AI-powered browser on the market today.
An ancient wall, freshly demolished
To understand what the researchers found, you have to understand the same-origin policy. It is one of the oldest and most consequential rules on the web, built up over 30 years, layer by layer, in response to every worm, cross-site script, and data leak that attackers have thrown at it. The rule is simple: content loaded from one website, say, your bank’s online portal, cannot read data loaded from another website running in the same browser tab. An ad iframe on a news site cannot reach into your Gmail session. This invisible firewall is the reason you can have 10 tabs open without each one pillaging the others.
AI-powered browsing agents demolish that firewall on purpose.
The researchers, David Kohlbrenner, Franziska Roesner, and their collaborators, tested seven AI browsers: ChatGPT Atlas, Claude for Chrome, Perplexity Comet, Brave Leo AI, Chrome with Gemini, Microsoft Edge with Copilot, and Firefox AI Mode. What they found was a security landscape with no safe position. To be useful, an AI agent must see everything the user sees. That includes content from cross-origin iframes, sidebar widgets, embedded social media posts, and third-party advertisements. Without full access, the agent cannot summarize a page, answer questions about its contents, or execute complex tasks. But with full access, every site the user visits gains a potential channel into every other site’s data, routed through the agent’s permissions.
The two attack vectors
Kohlbrenner’s team identified two concrete ways attackers can exploit this architectural concession. The first is prompt injection. A malicious line of text hidden inside an ad, a comment thread, or a seemingly benign iframe can trick the AI into misinterpreting data as instructions. The agent reads the poisoned content, believes it is being given a legitimate command, and acts on it, potentially forwarding sensitive information, clicking dangerous links, or executing actions the user never intended.
This is not a hypothetical. The researchers demonstrated working injection attacks across multiple AI browsers. The agent cannot distinguish between content the user wants analyzed and content that is actively trying to manipulate it, because from the agent’s perspective, both are just text in the same unified view of the page.
The second vector is memory poisoning. AI agents do not process a page and then forget it. They store information in memory to build context, track tasks, and improve future responses. The researchers found that these agents routinely mingle information drawn from different origins in the same memory store. A snippet of text from a malicious website can become entangled with data from a secure banking session. Once mingled, that stored data is vulnerable to extraction by a subsequent request from any origin the agent has permission to read.
The agency trap
Here is the uncomfortable truth the Rio de Janeiro presentation laid bare: the more useful an AI browser is, the worse its security profile. The most agentic products in the study, ChatGPT Atlas, Claude for Chrome, and Perplexity Comet, were also the most vulnerable. They offer richer automation, deeper integration with user accounts, and more persistent memory. Every added capability widens the attack surface.
Conversely, the browsers that fared better in the security analysis were the ones that do less. Brave Leo AI, Microsoft Edge with Copilot, and Firefox AI Mode earned relatively cleaner reports, but only because they take a more cautious approach to agentic features. They are safer by being less ambitious. That is not a solution. It is a trade-off that no amount of engineering has yet resolved.
Companies investing heavily in AI browsing say they are aware of the risks and are working on mitigations. But the researchers were skeptical that the problem can be engineered away within the current browser architecture.
“Browser agents aren’t ready for the public,” Kohlbrenner told the workshop audience.
Roesner framed the deeper challenge in terms of competitive dynamics. “Companies are pushing out these browsers because they’re under competitive pressure. But how to make them safe is still an open question.”
A structural contradiction
The core issue is not that engineers have failed to implement prompt sanitization properly or that memory isolation needs a stronger encryption scheme. It is that the fundamental design of AI browsing agents contains a contradiction. To act on the web, an agent needs permission to read and write across the same boundaries that 30 years of security engineering were built to enforce. You cannot give an agent agency, the ability to make decisions and execute actions on the user’s behalf, without also giving it the access that agency requires. And you cannot give it that access without dismantling the same-origin policy that has kept the web from descending into chaos.
This is what the researchers mean when they say the problem is architectural. It is not a flaw in a specific implementation that can be fixed in a point release. It is a tension between agency and containment that is baked into the definition of what an AI browser is supposed to do.
The user’s email, calendar, bank account, and medical records all live on different origins. A truly useful agent needs to read from all of them to schedule appointments, track expenses, or summarize communications. But the moment the agent can read across origins, it also becomes a potential vector for data to flow from the bank to the ad network, bypassing every security boundary the user thought was in place.
What comes next
Kohlbrenner, Roesner, and their team have published the full results under the title “Security Analysis of AI-Powered Web Browsing Agents,” presented at the Agents in the Wild Workshop in Rio de Janeiro on April 26, 2026. The paper does not offer a fix, and the authors do not pretend to have one. It catalogs the problem with precision and leaves the industry to wrestle with the implications.
Proposed mitigations include sandboxed agents with per-origin memory stores, explicit user confirmation for cross-origin actions, and new browser APIs for structured data access. But each approach reduces the agent’s usefulness. The trade-off is inescapable.
The public interest question is whether the market will allow companies to step back from aggressive agentic features long enough to build something safe. The competitive pressure Roesner described is not easing. Every major browser vendor now ships an AI assistant, and each is racing to add more capability. The safest AI browser on the market today is the one that does the least, but that is not the product the marketing teams want to sell.
The Rio de Janeiro presentation ended not with a solution, but with a warning. The same-origin policy took three decades to harden. AI browsers have disabled it in three years. And nobody has figured out how to build it back while keeping the intelligence inside.
Reference
Kohlbrenner, D., Roesner, F. et al. “Security Analysis of AI-Powered Web Browsing Agents.” Agents in the Wild Workshop, Rio de Janeiro, April 2026.