Prompt injection attacks expose security flaws in AI browsers
Researchers demonstrated that malicious instructions hidden in web content can trick AI-powered browsers into executing unintended actions and leaking sensitive user data like email addresses and passwords. OpenAI has stated that prompt injection attacks cannot be fully patched in AI systems.
What happened
Researchers from Brave tested Perplexity's Comet browser by asking it to summarize a Reddit thread that contained a malicious instruction hidden in one of the comments.
The AI browser read the hidden instruction, treated it as a legitimate command from the user, and started sharing the user's email and one-time password (OTP) in the Reddit comments.
Reported impact
Prompt injections can force AI browsers to leak sensitive user data such as email addresses and one-time passwords.
AI browsers with agentic capabilities can be forced by compromised domains to access all logged-in accounts across multiple tabs and perform actions across an entire browsing session.
Index analysis
Large language models powering AI browsers cannot reliably distinguish between user instructions and malicious instructions embedded in web content.
AI browsers learn about users to provide convenience features, capturing sensitive data that increases the scope of potential compromise if attacked.
OpenAI has admitted that prompt injection attacks cannot be fully patched in AI systems.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.