UW researchers find same-origin policy bypasses in AI browsers
Researchers at the University of Washington found that four of seven agentic AI browsers can be exploited to bypass same-origin policy protections, allowing attackers to steal user credentials and sensitive information. They demonstrated a successful proof-of-concept attack on ChatGPT Atlas and identified similar vulnerabilities in browsers from Google, Anthropic, and Perplexity AI.
What happened
A University of Washington team studied seven popular agentic AI browsers and found that four create ways for malicious actors to bypass the same-origin policy, a fundamental cybersecurity protocol that prevents websites open in a browser from interacting with each other's information.
Researchers ran a successful proof-of-concept cyberattack on ChatGPT Atlas in which a website stole information from another website embedded in it. They also identified conditions for similar attacks in Chrome with Gemini, Claude for Chrome, and Perplexity Comet.
Reported impact
Users of agentic AI browsers with broad agent permissions cannot trust that their sensitive information is protected, according to David Kohlbrenner, a UW assistant professor. Researchers warned that if agents have access to a browser containing user credentials such as email or bank account information, the systems are not yet ready to truly protect that information.
Index analysis
The same-origin policy, introduced in 1995, is a fundamental security measure that keeps different websites from interacting with each other even if one is embedded in another. This policy evolved over 30 years to allow users to safely visit most websites without careful vetting.
Governance controls
Browsers that gave agents fewer permissions were generally safer, according to the UW research.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.