- 01Browser agents that operate under a user's authenticated session have access to every application that session has access to. Credential scope is the primary risk boundary and must be managed explicitly.
- 02Web content is attacker controlled text. Any browser agent that renders web pages and processes their content is exposed to indirect prompt injection from any page it visits.
- 03Browser agents must not be granted persistent access to enterprise application sessions. Actions should be scoped to defined task sessions with short lived credentials that expire when the task completes.
- 04User consent at the action level, not just the session level, is the appropriate model for high consequence browser agent actions. The user should approve what the agent is about to do, not just that the agent may operate in their session.
Browser agents that can navigate the web, interact with enterprise applications, and take actions on behalf of authenticated users represent a qualitatively new risk surface. Unlike a chatbot that produces text, a browser agent executes actions with real world consequences within the scope of the user's active authentication context.
The risk is not primarily that the agent will malfunction or produce incorrect output. It is that the agent can be directed by web content it encounters during a task to take actions that were not authorized by the user. Web content is attacker controlled text. Any system that reads and acts on web content is exposed to instruction injection through that content.
The Credential Scope Problem
A browser agent operating under a user's authenticated session inherits all of that session's access. If the user is authenticated to their email, their file storage, their HR system, and their enterprise applications, the browser agent can access all of those systems as part of any task, even a task that was only intended to interact with one of them.
The control is to prevent browser agents from operating under broad, long lived user sessions. Each agent task session should be provisioned with the minimum credentials required for that specific task, scoped to the applications and actions that task requires, and expired when the task completes.
- 01Task scoped credentials provisioned per browser agent task, not per user session
- 02Application scope declared at task initiation, with credentials limited to that scope
- 03Credential expiry tied to task completion or a defined timeout, whichever comes first
- 04No persistent browser agent access to enterprise application sessions outside of active task execution
- 05Audit log of every application access and every action taken during each task session
A browser agent operating under a full enterprise SSO session has access to everything that session has access to.
If a user authorizes a browser agent to help them with an expense report and the agent is operating under their full SSO session, a prompt injection attack from any web page the agent visits during that task has access to the user's email, file storage, and every enterprise application in scope. Task scoped credentials prevent this lateral movement regardless of whether the injection succeeds.
Indirect Prompt Injection Through Web Content
Indirect prompt injection through web content is the most practically relevant attack against browser agents. An adversary who knows that enterprise employees use an AI browser agent for a specific task type can craft a web page that contains hidden instructions designed to redirect the agent's behavior when it visits that page as part of a legitimate task.
The attack does not require compromising the enterprise environment. It only requires that the agent will visit an adversary controlled page, which is a realistic assumption for any agent that browses the public web as part of its task. A job listing page, a vendor website, a public document, or a news article are all plausible injection surfaces.
The architectural defense is the same isolated planner pattern applied in other agentic contexts. Web page content should be processed by a view only model that produces a structured task relevant summary. The action taking model sees only the structured summary, not the raw page content. An adversary who can inject instructions into a web page can only affect the summary content within the schema's constraints, not issue arbitrary instructions to the action taking model.
Hidden text injection is the most common browser agent attack pattern in research.
Injection instructions are often embedded in web pages as white text on white background, in zero font size elements, or in HTML comments that screen readers and browsers do not display but that language models processing the page content will read. The view only model plus schema validation pattern prevents these from reaching the action taking model regardless of how they are hidden.
User Consent at the Action Level
Session level consent is not sufficient for browser agents that take consequential actions. A user who authorizes a browser agent to assist with a task has authorized the task objective, not every individual action the agent might take to accomplish it. For high consequence actions, the agent should surface the specific action for user approval before executing it.
The practical implementation is an action approval workflow where the agent presents the planned action in plain language, the action's expected consequences, and an approve or cancel option before any irreversible action is executed. This adds a step but it is the step that prevents a misunderstood task objective from becoming an unintended data modification or unauthorized submission.
/Browser Agent Action Approval Requirements
| Action type | User approval required | Reason |
|---|---|---|
| Read only navigation | No | No state change |
| Form fill with user provided data | Review only | Low risk, user supplied content |
| Form submission | Yes, confirm before submit | State change in target system |
| File upload or download | Yes, show file and destination | Data movement across boundaries |
| Authentication to a new service | Yes, show service and scope | Credential scope expansion |
| Delete or modify existing records | Yes, explicit approval | Potentially irreversible |
Metrics and Closing Actions
Track the fraction of browser agent task sessions that used task scoped credentials rather than full user session credentials, the rate of indirect prompt injection attempts detected through the view only model's anomaly flags, the coverage of high consequence action types under the user approval workflow, and audit log completeness for browser agent task sessions.
The closing action is to identify the browser agent deployments in your environment and determine which of them are operating under full user session credentials rather than task scoped credentials. For each such deployment, document the credential scope and schedule a scoping exercise to define the minimum credential set required for each task type. That scoping exercise is the foundation for every other browser agent security control.