The security community has been warning about prompt injection since the first LLM-powered assistants shipped, but new research confirms what many of us suspected: there is no silver bullet. AI-native browsers — including OpenAI's ChatGPT Atlas, Perplexity's Comet, The Browser Company's Dia, and Microsoft's Copilot integration in Edge — remain vulnerable to indirect prompt injection attacks even after multiple rounds of vendor guardrails. OpenAI itself has publicly conceded that prompt injection in agentic browsing may never be fully solved, and that candor should recalibrate every defender's expectations.
The risk profile here is fundamentally different from a traditional browser vulnerability. These agents don't just render content — they read it, reason over it, and act on it with the user's authenticated session. A malicious instruction embedded in a web page, an email, a shared document, or even an image can hijack the agent into exfiltrating data from open tabs, sending messages on the user's behalf, making purchases, or navigating to attacker infrastructure. Researchers have repeatedly demonstrated that hidden instructions in page content, HTML comments, screenshots, and even URL fragments can redirect agent behavior despite content filters, action confirmations, and sandboxing layers.
If your organization has users running AI browsers — and in 2026, it does, whether sanctioned or not — this is a data-loss and session-abuse problem sitting on your endpoints today. This post breaks down the attack mechanics, what vendor mitigations actually do and don't cover, and the detection engineering, containment, and governance controls you should implement now.
Technical Analysis
Affected Products and Platforms
The vulnerable class spans every major agentic browsing product currently on the market:
- OpenAI ChatGPT Atlas (macOS, Windows) — agent mode with cross-tab context and action-taking capability
- Perplexity Comet (Windows, macOS) — assistant sidebar with autonomous browsing and task execution
- The Browser Company Dia — AI-first browser with agentic page interaction
- Microsoft Edge with Copilot — Copilot Vision and agentic actions over page content
- Google Chrome with Gemini integration — page-context reasoning features
No CVE identifiers have been assigned to these flaws, and that is the point: this is not a patchable memory-corruption bug. It is an architectural weakness in how large language models consume untrusted content. The model cannot reliably distinguish data (the web page it was asked to summarize) from instructions (a command embedded in that page telling it to email your open tabs to an external address). Vendors mitigate; they cannot remediate.
How the Attack Works — Defender's View
The attack chain for indirect prompt injection against an AI browser typically looks like this:
- Delivery: The attacker plants instructions in content the agent will ingest — a web page, a phishing email opened in the browser, a calendar invite, a shared doc, a Reddit post, or text rendered via CSS (white-on-white text, zero-height divs) that is invisible to the user but fully visible to the model.
- Ingestion: The user (or the agent autonomously) asks the AI browser to summarize, analyze, or act on the page. The malicious instruction enters the model's context window alongside legitimate page content.
- Instruction override: The injected directive hijacks the agent's task. Classic payloads instruct the agent to read the contents of other authenticated tabs (webmail, CRM, banking), extract data, and transmit it — typically by navigating to an attacker-controlled URL with the data encoded in the query string, or by composing and sending an email/message from the user's session.
- Action execution: Because the agent operates with the user's cookies and sessions, no credential theft is required. Guardrails such as action-confirmation prompts are routinely bypassed via instruction chaining, obfuscation, or by framing the malicious action as a continuation of the user's own request.
- Exfiltration/persistence: Data leaves via HTTPS to attacker infrastructure — indistinguishable from legitimate browsing at the network layer unless you are inspecting destination and payload patterns. Some demonstrations have also shown agents installing persistent instructions into their own memory/preference stores, re-infecting future sessions.
Key exploitation requirements are trivially low: the victim must use an AI browser with agentic features enabled, and the agent must ingest attacker-controlled content. There is no exploit binary, no memory corruption, and frequently no user-visible anomaly.
Why Guardrails Keep Failing
Vendors have layered defenses — content sanitization, instruction hierarchies, origin isolation, confirmation dialogs for sensitive actions, and logged-out browsing modes. The research summarized by Dark Reading shows these controls fail for structural reasons:
- The model is the attack surface. Any text the model reads is potentially executable. Sanitization is an arms race against an adversary who can encode, translate, split, or image-embed instructions.
- Confirmation fatigue and social framing. Action-approval prompts are bypassed when the injected instruction convinces the model the user already consented, or bundles the malicious action into an innocuous-looking task.
- Cross-context bleed. Agents with memory, cross-tab access, or logged-in sessions create lateral movement paths within the browser itself — a poisoned recipe blog can reach into an open corporate webmail tab.
- Multimodal vectors. Text rendered inside screenshots and images bypasses text-layer filters entirely.
Exploitation Status
There is no CISA KEV entry and no CVE — this is technique-level risk, not a discrete vulnerability. However, multiple independent research teams (including browser-security researchers and red teams at the vendors themselves) have published working demonstrations against production builds of Atlas, Comet, and Copilot in Edge. OpenAI has acknowledged the residual risk publicly and shipped mitigations including a logged-out agent mode — an implicit admission that logged-in agentic browsing cannot be made safe against a determined injector. Treat this as exploitable today, in the wild, against any organization whose users run these tools against attacker-influenced content — which is to say, the open internet.
Detection & Response
Detecting prompt injection at the model layer is the vendor's problem. Detecting the observable outcomes — an AI browser process taking unexpected actions, spawning unexpected children, writing unexpected files, or talking to unexpected destinations — is yours. The detections below target the post-exploitation behaviors a hijacked agent produces on the endpoint.
---
title: AI Browser Process Spawning Script Interpreter or Shell
id: 3f8a1c92-6d47-4b1e-9a52-7c3e5d8f9012
status: experimental
description: Detects agentic AI browser processes (ChatGPT Atlas, Perplexity Comet, Microsoft Edge Copilot components) spawning command shells or script interpreters. A hijacked agent instructed to run local commands, or abusing browser-downloaded payloads, may produce this behavior. Legitimate AI browsers do not spawn cmd, powershell, or sh during normal operation.
references:
- https://www.darkreading.com/application-security/no-perfect-fix-ai-browser-prompt-injection-flaws
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\atlas.exe'
- '\comet.exe'
- '\dia.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\mshta.exe'
- '\rundll32.exe'
condition: selection_parent and selection_child
falsepositives:
- Browser auto-update mechanisms (typically signed and from update directories — verify signer)
- Rare extension or helper installation flows
level: high
---
title: AI Browser Writing Executable Content to User-Writable Directories
id: 9b2e4d17-8c53-4f6a-b3e1-2a7d9c5f1034
status: experimental
description: Detects AI browser processes writing executable or script files to Downloads, Temp, or AppData. A prompt-injected agent instructed to 'download a tool' or stage a payload produces file writes from the browser process that differ from normal cache/download patterns, particularly script and executable types.
references:
- https://www.darkreading.com/application-security/no-perfect-fix-ai-browser-prompt-injection-flaws
- https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.command_and_control
- attack.t1105
logsource:
category: file_event
product: windows
detection:
selection_image:
Image|endswith:
- '\atlas.exe'
- '\comet.exe'
- '\dia.exe'
selection_path:
TargetFilename|contains:
- '\Downloads\'
- '\AppData\Local\Temp\'
- '\AppData\Roaming\'
selection_ext:
TargetFilename|endswith:
- '.exe'
- '.dll'
- '.ps1'
- '.bat'
- '.js'
- '.vbs'
- '.hta'
condition: selection_image and selection_path and selection_ext
falsepositives:
- User-initiated legitimate downloads of tools or installers through the AI browser
level: medium
Notes on tuning: The process names above reflect current shipping binaries — validate them against your own software inventory before deployment, and add Chromium-embedded variants if your telemetry shows the agents running as renderer processes under a different parent. If your environment has not sanctioned AI browsers, the higher-fidelity detection is simpler: alert on the mere presence of these binaries. The network-layer signal (agent exfiltrating via encoded query strings) is difficult to distinguish from legitimate browsing without TLS inspection, which is why the egress-control recommendations in the Remediation section matter more than network detection here.
// Hunt: AI browser processes spawning unexpected child processes
// or making outbound connections to non-standard destinations.
// Requires Defender for Endpoint device data.
let AIBrowsers = dynamic(["atlas.exe", "comet.exe", "dia.exe"]);
let LLMEndpoints = dynamic(["openai.com", "chatgpt.com", "perplexity.ai", "anthropic.com", "googleapis.com", "bing.com", "microsoft.com"]);
let SuspiciousChildren = DeviceProcessEvents
| where InitiatingProcessFileName in~ (AIBrowsers)
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","mshta.exe","rundll32.exe","wscript.exe","cscript.exe")
| project ChildTime=TimeGenerated, DeviceName, ChildProcess=FileName, ChildCmdLine=ProcessCommandLine, AIBrowser=InitiatingProcessFileName, AccountName;
let UnusualEgress = DeviceNetworkEvents
| where InitiatingProcessFileName in~ (AIBrowsers)
| where ActionType == "ConnectionSuccess"
| extend RemoteHost = tostring(split(RemoteUrl, "/")[0])
| where not(RemoteUrl has_any (LLMEndpoints))
| summarize ConnectionCount=count(), DistinctDestinations=dcount(RemoteUrl), SampleDestinations=make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, bin(TimeGenerated, 1h)
| where DistinctDestinations > 15; // Agents browsing broadly is expected; spikes of many NEW destinations in one hour are not
SuspiciousChildren
| union UnusualEgress
| order by ChildTime desc
-- Artifact: SecurityArsenal.AIBrowser.HijackHunt
-- Hunts for AI browser processes and any unexpected child processes,
-- which can indicate a prompt-injected agent executing local actions.
LET ai_browsers = {"atlas.exe", "comet.exe", "dia.exe"}
LET agents = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE lower(Name) IN ai_browsers
SELECT a.Pid AS AgentPid,
a.Name AS AgentName,
a.Username AS AgentUser,
a.CreateTime AS AgentStart,
c.Pid AS ChildPid,
c.Name AS ChildName,
c.Exe AS ChildExe,
c.CommandLine AS ChildCommandLine,
c.CreateTime AS ChildStart
FROM agents AS a
JOIN (SELECT Pid, Ppid, Name, Exe, CommandLine, CreateTime FROM pslist()) AS c
ON c.Ppid = a.Pid
WHERE c.Name =~ '(?i)(cmd|powershell|pwsh|mshta|rundll32|wscript|cscript|curl|wget)'
# SecurityArsenal-AIBrowserAudit.ps1
# Inventories agentic AI browsers across endpoints, reports versions,
# and optionally applies outbound firewall restrictions for unmanaged installs.
# Run elevated. Use -Enforce to apply restrictions; audit-only by default.
param([switch]$Enforce)
$AIBrowserPaths = @(
"$env:LOCALAPPDATA\Programs\Atlas\atlas.exe",
"$env:LOCALAPPDATA\Programs\Comet\comet.exe",
"$env:LOCALAPPDATA\Programs\Dia\dia.exe",
"$env:PROGRAMFILES\Perplexity\Comet\comet.exe"
)
$report = @()
foreach ($path in $AIBrowserPaths) {
if (Test-Path $path) {
$info = (Get-Item $path).VersionInfo
$report += [PSCustomObject]@{
Product = $info.ProductName
Version = $info.ProductVersion
Path = $path
SignedBy = (Get-AuthenticodeSignature $path).SignerCertificate.Subject
LastModified = (Get-Item $path).LastWriteTime
}
if ($Enforce) {
# Block outbound from the agent binary except to vendor LLM endpoints.
# NOTE: A full block is safer for UNSANCTIONED installs.
$ruleName = "Block-AIBrowser-Egress-$(Split-Path $path -Leaf)"
if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
New-NetFirewallRule -DisplayName $ruleName `
-Direction Outbound -Program $path -Action Block `
-Profile Any -Description "Security Arsenal: contain unsanctioned AI browser egress"
Write-Host "[+] Firewall block applied: $path" -ForegroundColor Yellow
}
}
}
}
# Check Edge Copilot / agentic features policy state
$edgePolicy = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"
$copilotDisabled = $null
if (Test-Path $edgePolicy) {
$copilotDisabled = (Get-ItemProperty $edgePolicy -Name "HubsSidebarEnabled" -ErrorAction SilentlyContinue).HubsSidebarEnabled
}
if ($report.Count -eq 0) {
Write-Host "[-] No agentic AI browsers found at known install paths." -ForegroundColor Green
} else {
$report | Format-Table -AutoSize
Write-Host "[!] $($report.Count) AI browser install(s) found. Verify sanction status and version currency." -ForegroundColor Red
}
Write-Host "[i] Edge sidebar/Copilot policy value (0 = disabled): $copilotDisabled"
$report | Export-Csv -Path ".\AIBrowserAudit-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Remediation
There is no patch to apply, because there is no discrete bug. Remediation for this threat class is architectural and procedural. Prioritize in this order:
1. Establish governance immediately. Publish an explicit policy on agentic AI browsers: which products are sanctioned, for which roles, and with what data-access boundaries. If you cannot articulate a business requirement for an agent that reads authenticated webmail and acts autonomously, the answer is to block it. Use AppLocker, WDAC, or your EDR's application control to enforce the block for unsanctioned installs — the audit script above gives you the inventory to start from.
2. Enforce logged-out / least-privilege agent modes. Where AI browsers are sanctioned, require configurations in which the agent operates without the user's authenticated sessions. OpenAI's logged-out agent mode for Atlas exists precisely because logged-in agentic browsing carries unresolvable injection risk. Disable cross-tab context access and agent memory where the product permits it.
3. Constrain the blast radius with egress controls. Prompt injection exfiltration rides out over HTTPS to arbitrary attacker domains. Deploy explicit egress policies: proxy AI browser traffic, allowlist known LLM vendor endpoints, and alert on these processes initiating connections to newly registered or uncategorized domains. DLP rules should treat the AI browser process as a high-risk exfiltration channel — equivalent to an unmanaged personal cloud sync client.
4. Reduce high-value exposure in browser sessions. The most damaging demonstrations involve the agent reading open authenticated tabs (webmail, CRM, financial systems). Enforce session isolation: separate browser profiles or dedicated hardened browsers for privileged SaaS access, short session lifetimes, and conditional access policies that bind sessions to device posture.
5. Treat agent output as untrusted input downstream. Any workflow that consumes AI browser output — automated summaries, ticket creation, email drafting — must sanitize it the way you sanitize any external input. Agents can be induced to embed malicious links or content in their own output, propagating the injection to the next system or human in the chain.
6. Train users on the actual threat model. Users must understand that viewing attacker-influenced content through an agent is categorically different from viewing it in a normal browser. The page can talk to the agent even when it says nothing to the human. Awareness briefings should include the known vectors: hidden page text, malicious emails/documents the agent is asked to summarize, and instructions embedded in images.
7. Track vendor advisories continuously. Monitor security release notes for ChatGPT Atlas, Perplexity Comet, and Edge Copilot, and apply updates within your standard browser patch SLA. Vendors are shipping guardrail improvements on a rapid cadence; while none are complete, each narrows the attack surface. Also monitor CISA KEV and your threat intel feeds — if a discrete, patchable vulnerability in one of these products is assigned a CVE, your vulnerability management process should already be positioned to respond.
The uncomfortable takeaway from this research is that prompt injection in agentic browsing is closer to phishing than to buffer overflows: it can be reduced, detected, and contained, but it cannot be patched away. Plan your controls accordingly — assume the agent will eventually be hijacked, and engineer the environment so that a hijacked agent has nothing valuable to reach.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.