Prompt Injection Attacks in AI Browsers: What They Are and How to Not Get Burned

AI browsers like Perplexity Comet and ChatGPT Atlas read web pages as instructions, which means a hidden line of text on any page can hijack your agent. This piece explains the mechanics of indirect prompt injection, walks through the documented 2025 incidents, explains why it has no clean fix, and gives a practical usage policy for individuals and teams.

What the attack actually is

A prompt injection attack on an AI browser happens when a webpage contains text that the browsing agent reads as an instruction rather than as content. The agent has no reliable way to separate what you asked it to do from what the page told it to do, so it tries to satisfy both. That is how a buried Reddit comment or a line of white-on-white text in a PDF can end up telling your browser to open your email tab, read a one-time password and post it somewhere.

The version that matters here is indirect prompt injection. You are not the one typing the malicious prompt. You type something innocent, like summarise this page or find me the cheapest flight, and the agent pulls in content from the open web that carries the payload. OWASP lists this as LLM01, the top risk in its Large Language Model list, and it has been known since 2023. What changed in 2025 is that the model stopped being a chatbot in a box and got hands: your cookies, your logged-in sessions, your clipboard, your ability to click Buy.

That is the whole shift. A jailbroken chatbot writes you a rude poem. A hijacked browser agent is already authenticated into your Gmail.

The 2025 incidents, in order

This is not theoretical and it is not fringe research. Every major agentic browser shipped in 2025 has been publicly broken, usually within weeks of launch, and in one case the vendor broke it themselves before anyone else could.

The Anthropic number is the honest one to sit with. When they piloted Claude for Chrome in August 2025, their own red team ran browser-use attacks and found a 23.6 percent success rate. After adding mitigations, permission prompts, blocked site categories, classifiers, it fell to 11.2 percent. That is a company doing careful work, publishing the result, and still shipping something that fails roughly one in nine adversarial attempts. They limited the preview to 1,000 users for exactly that reason.

When	Product	What was shown	Where it stands
Aug 2025	Perplexity Comet	Brave researchers hid instructions inside a Reddit comment. Asking Comet to summarise the page led it to visit the user's account page, read their email address, trigger an OTP and leak it back to the attacker.	Patched after disclosure
Aug 2025	Claude for Chrome	Anthropic's own testing found a 23.6% attack success rate on browser-use attacks, reduced to 11.2% with mitigations.	Limited preview, 1,000 users
Oct 2025	ChatGPT Atlas	OpenAI's security lead publicly described prompt injection as an unsolved frontier problem at launch. Researchers separately showed the omnibox could be fed disguised instructions.	Ongoing, mitigations layered
Oct 2025	Comet (CometJacking)	LayerX showed a single crafted link could make the agent read connected data and encode it to slip past exfiltration filters.	Reported to vendor
2025	Screenshot and image injection	Instructions embedded in images, faint text a human eye skips, picked up when the agent OCRs a screenshot.	Open class of attack

Why this does not have a clean fix

SQL injection was solved. Not perfectly, but properly, with parameterised queries. You tell the database which part of the string is code and which part is data, and it stops guessing. That separation is the entire fix.

Language models do not have that separation. Your system prompt, your typed request and the contents of a random page all arrive as the same stream of tokens. There is no privileged channel. Vendors approximate one by training the model to trust some sources more than others, wrapping page content in delimiters, and running classifiers to catch suspicious text. All of that is probabilistic. An attacker with unlimited attempts and no cost per attempt will eventually find phrasing that lands, and unlike a software bug, the failure is not reproducible-then-patchable in a satisfying way. You fix one phrasing, the next one works.

So when OpenAI says prompt injection is unsolved, take it at face value rather than as legal hedging. The current defences are real and they do help. They are not a boundary. They are a filter.

How to use an AI browser without handing over your accounts

You do not have to abandon these tools. Agentic browsing genuinely saves time on research, comparison and form filling. You just have to stop treating the agent as an extension of yourself and start treating it as a capable intern who reads everything on the internet and believes all of it.

The governing rule: never let the agent have both sensitive access and untrusted input in the same session. That single constraint kills most of the published attack chains.

• Run agent mode logged out. Comet and Atlas both offer a mode where the agent browses without your cookies and session tokens. Use it as the default and only log in when the task truly needs it.
• Keep a separate browser profile for banking, email, brokerage and admin panels, and never run agent tasks in it.
• Do not turn the agent loose on user-generated content. Reddit threads, comment sections, scraped PDFs and shared docs are where payloads live.
• Read the action log before approving anything irreversible. If the agent proposes a step you did not ask for, that is the tell.
• Turn off persistent memory for agentic sessions. Memory turns a one-shot injection into a payload that fires again later.
• Treat any request to enter credentials, an OTP or a payment detail as a hard stop, always done by you, manually.
• Assume anything you paste into the agent's context can be exfiltrated by a later injection in the same session.

If you are the person deciding this for a team

Most Indian companies are about to face this as a shadow IT problem, not a procurement decision. Someone in sales installs Comet because it fills CRM fields faster. Someone in finance points Atlas at a vendor portal. Nobody filed a ticket. Your SSO logs will not distinguish an agent acting on a hijacked instruction from a legitimate employee click, because from the server's side it is the same authenticated session.

A blanket ban usually fails, because the productivity gain is real and people route around policy. What works better is a narrow allowlist: agentic browsing permitted for research and drafting, blocked on any system holding customer data, payments or credentials, with mandatory logged-out mode. Write it down, in two paragraphs, and tell people why rather than just what. The teams that get this wrong are almost always the ones where nobody understood the mechanism, only the headline.

That understanding is the part you cannot outsource to a policy document. If your team is rolling out agentic tools and you want them to build things with a working mental model of how these systems fail, a structured session beats a Slack warning, which is the sort of thing our AI Masterclass formats are built for, with mentor-led implementation rather than a slide deck.

The thing to hold onto: an AI browser is not a browser with a helpful sidebar. It is a program that takes instructions from strangers and executes them with your permissions. Once you see it that way, the right level of caution becomes obvious.

FAQs

1. Is ChatGPT Atlas safe to use for everyday browsing?

For reading, searching and drafting, it is broadly fine. The risk concentrates in agent mode acting on pages you did not write while logged into sensitive accounts, so use logged-out agent mode and keep banking and email in a separate browser profile.

2. What is the difference between prompt injection and jailbreaking?

Jailbreaking is you trying to make the model break its own rules. Prompt injection is a third party smuggling instructions into the model's input so it acts against you, usually through a webpage, email or document the model reads on your behalf.

3. Can antivirus or a firewall stop prompt injection?

No. The malicious content is ordinary text on an ordinary page, and the resulting requests come from your own authenticated browser session, so nothing at the network or endpoint layer sees anything abnormal.

4. What was CometJacking?

CometJacking was an attack disclosed by LayerX in October 2025 showing that a single crafted link could instruct Perplexity's Comet browser to pull data from connected services and encode it so that exfiltration filters would not catch it. It required only that the user click the link.

5. Does using an AI browser in logged-out mode make it completely safe?

It removes the highest-impact outcomes, because an injected instruction cannot read accounts the agent is not signed into. The agent can still be misled into showing you wrong information or steering you to a scam site, so judgement on the output still matters.

6. Should companies block AI browsers entirely?

Blanket bans tend to push usage into shadow IT rather than stopping it. A narrow allowlist works better: allow agentic browsing for research and drafting, block it on systems holding customer data, payments or credentials, and require logged-out agent sessions.