Researchers Expose Prompt Injection and Cross-Origin Risks in AI Browsers

Researchers and vendors have disclosed serious security weaknesses in AI-enabled browsers, warning that agentic features can undermine core browser protections such as the same-origin policy, tab isolation, and safe handling of cross-origin content. A study cited by Live Science found inconsistent security behavior across seven AI browsers and concluded that more capable products often introduced greater risk, including exposure through prompt injection, multi-tab visibility, and unsafe memory handling. Brave separately detailed indirect prompt injection risks in its discussion of Perplexity Comet, highlighting how malicious web content can manipulate browser agents through embedded instructions.

A separate vulnerability chain in OpenAI’s ChatGPT Atlas browser showed how these design risks can translate into account-compromise scenarios. According to Hacktron AI, exposed Chromium Mojo IPC interfaces were reachable from broadly allowlisted OpenAI web origins, and researchers chained a postMessage-based XSS on forums.openai.com with a login CSRF flaw to execute JavaScript on an authenticated OpenAI domain. From there, they were able to control Atlas browser functions, enumerate and manipulate tabs, and continuously read live tab URLs, enabling theft of OAuth authorization codes that could lead to takeover of accounts such as GitHub, Reddit, and Facebook. OpenAI said it fixed the issue in Atlas version 1.2025.288.15 and awarded a $5,000 bounty.