Browser agents
AI browser agents: why prompt injection is a long-term risk
An AI browser that can read pages, open email and take actions turns hidden text into a possible instruction. OpenAI itself says the problem is unlikely to ever be fully solved.
Last reviewed against NCSC (UK), OWASP Gen AI Security Project and UK Government (DSIT). Sources
The statement
What OpenAI said
In December 2025 OpenAI said prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully "solved" [9]. It described agent mode in ChatGPT Atlas as something that "expands the security threat surface" [9]. TechCrunch reported that researchers had shown shortly after launch that a few words in a Google Doc could change the browser's behaviour [9].
OpenAI's defences
Layers, not a cure
An OpenAI spokesperson declined to say whether the update measurably reduced successful injections [9]. That is worth noting when comparing vendor claims.
OpenAI described several measures [9]:
- An internal attacker model, trained to find prompt injections that work against browser agents
- A rapid cycle of testing and faster patches
- Training the agent to seek user confirmation before sending messages or making payments
- A security update after which agent mode detected and flagged an injected email in a demonstration
For your organisation
Practical limits
Limit logged-in access
The advice reported includes limiting logged-in access to reduce exposure [9]. An agent signed in to mail and finance systems has more to lose.
Read the confirmations
Review confirmation requests before an agent acts, and give agents specific instructions instead of broad latitude [9].
Decide on value
Wiz's Rami McCarthy argued that agentic browsers do not yet offer enough value for most everyday tasks to justify their risk, given their access to email and payment data [9]. That is one view, and your own judgement should rest on the tasks involved.
Policy
What to put in writing
The NCSC has also warned that prompt injection may never be totally mitigated, so limits matter more than hope [9] [1]. See how to reduce the risk.
Agree a position
Decide whether staff may use AI browsers or agent modes on work accounts, and for which tasks. The NCSC says security should be built into AI projects from the start [3], which includes browser tools adopted by individuals.
Keep reading
Read next
Ask suppliers
A buyer's list of questions on prompt injection for AI suppliers, drawn from NCSC and OWASP advice, for UK procurement and security leads.
Read the guide
Monitoring
What to log and watch for when AI tools may be attacked through prompt injection, based on NCSC and OWASP advice for UK security teams.
Read the guide
Timeline
Dated events on prompt injection, from NCSC guidance and the OWASP ranking to EchoLeak, the lethal trifecta and OpenAI's browser warning.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Prompt injection cannot be patched away, so the useful question is how far a manipulated tool could reach. Testing your AI-connected systems the way an attacker would shows where the limits on data and actions need tightening.