AI browsers: the same-origin policy is only as strong as the model

Open two tabs, one with your inbox and one with any website you do not control. For 30 years a rule has kept that second site from reading your inbox. It is called the same-origin policy, and it is built deep into the browser. Put an AI agent to work in the same browser and the rule still applies, but the agent is not bound by it. The agent sees both tabs, and whether it protects one site from the other is a decision made by the language model.

Three decades of a browser guarantee

The same-origin policy separates websites by origin. Scripts from one domain cannot reach content from another, no matter how many tabs are open. A large part of today's web security rests on that, together with CORS and anti-CSRF tokens.

An agent in the browser operates at a different level. It reads page content, types into fields, clicks and navigates, and it does all of that with your permissions and your sessions. Two researchers at the University of Washington sum up the consequence in a single sentence worth reading twice: "in such cases, the strength of the same-origin policy is reduced to the strength of the agent's defenses against prompt injections."

Prompt injection means that text on a web page is read by the model as an instruction. It can be a comment, a caption or invisible markup. The agent does not reliably separate what you want from what the page says.

Two research groups, one finding

Franziska Roesner and David Kohlbrenner examined seven browsers and presented their work at an ICLR workshop in April 2026. The browsers tested were Brave Leo AI, ChatGPT Atlas with and without agent mode, Chrome with Gemini, Claude for Chrome, Edge with Copilot, Firefox AI Mode and Perplexity Comet. A second group from Duke, Stanford and Berkeley reached the same conclusion independently and cites the Seattle work as earlier research.

Precision matters here, because exactly one browser was attacked successfully. That was ChatGPT Atlas in agent mode, where the researchers pulled data across origin boundaries. For Chrome with Gemini, Claude for Chrome and Perplexity Comet the preconditions for the same attack were met, and none of those three was broken. The authors write that their goal was not to develop sophisticated injections, but to test baseline responsiveness to page instructions.

Two secondary findings, both outside the cross-origin test, matter more in daily use than the headline. Masked password fields, the rows of dots, were read only by Atlas in a logged-in agent mode and by Claude for Chrome. Claude explained that during the test by saying it had used the read page tool, which reads the page's DOM, and the DOM holds the plain text. Injecting JavaScript was also possible only in Claude for Chrome, because it is built as an extension with access to all domains.

The tests ran in late January and early February 2026 on macOS, with the stable version of each browser available at the time. The paper names no version numbers anywhere. By the time you read this the measurements are roughly eight months old, and no independent retest exists. The work was funded in part by gifts from Microsoft, whose Edge is among the browsers with no documented finding.

The documented case started with a comment

Zenity Labs showed in August 2026 what this looks like in practice. A planted comment under a popular X post was enough to steer Atlas into sending a phishing wave to the victim's entire contact list from their own WhatsApp account. The agent opened WhatsApp Web, read the contacts and sent the message from the user's own number.

The striking part comes afterwards. Atlas had flagged WhatsApp as sensitive the whole time and kept the workflow ribbon red. It sent every message anyway. Zenity concludes that these defenses were mostly soft classifiers rather than hard boundaries, and that soft boundaries are labels, not access controls.

The limits matter here too. The payload only worked after it was rewritten in Hebrew and split across several scrolls of the page, because the filter is trained on English. Zenity called Atlas the most hardened agentic browser it had tested. Anyone reading the case as proof of unusually weak Atlas security misreads the researchers. Zenity reported the finding to OpenAI in January 2026, months before publishing it. In February 2026 OpenAI acknowledged meaningful risks associated with prompt injection in agentic environments. No patch followed and no CVE number either. As the researchers see it, this is not a bug with a fix but a design property of what an agentic browser is. In August we covered a comparable case, when a single email hijacked five AI browsers.

Atlas itself has been gone since Aug. 9, 2026, when OpenAI shut down the browser and moved the feature into the desktop app. The built-in browser there is allowed to do more than its predecessor. OpenAI's own documentation lists richer sign-in, autofill, password management, extensions, downloads and navigation, and it runs on its own browser state. Atlas in agent mode was allowed none of that. It could not download files, install extensions or reach saved passwords and autofill data. The security argument from that time no longer applies to the successor product. We looked at the limits of ChatGPT's cloud browser when ChatGPT started signing in to accounts and staying signed in.

What the vendors promise today

Google says in the Chrome help pages that Gemini in Chrome asks for permission first. Only then does Google Password Manager sign in to a site for the agent, and the manager does not share your passwords with Gemini. The agent never sees the password. The password manager types it. The same page also says that Chrome's safeguards do not guarantee protection against all risks. You are responsible for Gemini's actions during a task. The feature is available in the United States, for users 18 and older, on an AI Pro or Ultra plan, in English, and not in Incognito mode.

Anthropic puts the success rate of attacks against its own configuration at less than 0.08 percent and immediately adds that the risk is not zero. Passwords go through 1Password and, by Anthropic's account, never enter Claude's context. The company says nothing about the researchers' finding on masked fields. That is a gap, not a rebuttal.

Microsoft makes the clearest commitment in the field. While Copilot is browsing and interacting with webpages in Edge, it cannot access autofill data, saved passwords or wallet information. The limit follows immediately. Copilot can access cookies, which means that wherever you are already signed in, so is Copilot.

Perplexity describes four protective layers and confirmation prompts for mail, calendar and the final purchase, while calling prompt injection an unsolved problem across the industry. The company says nothing about saved passwords. Brave is the only vendor taking an architectural approach and runs agentic browsing in an isolated browsing profile, where cookies, logged-in state, caches and other site data do not cross profiles. That separation is behind a switch that is off by default.

A second profile helps, but not everywhere

Anthropic and Microsoft both recommend a separate browser profile for the agent, and Microsoft suggests starting with a brand-new one. Brave builds the separation in. Google recommends it nowhere. Chrome's help page lists separate profiles only for shared computers and for keeping work and personal accounts separate.

A second profile works reliably against the takeover of cookies and signed-in sessions. It does not work against the researchers' finding, because the cross-origin data theft happens inside the same session, between two sites the agent is allowed to see in any case. Anyone who creates the profile and then feels safe has solved half the problem and mistakes it for the whole.

The Seattle researchers go further than any vendor recommendation. They advise users to avoid agentic browsers. Kohlbrenner said in June that browser agents aren't ready for the public, and Roesner called the development a big step back for browser security after 30 years of building up the same-origin policy.

How to keep the risk small

The agent inherits your sessions. It reaches every account you are signed in to while it runs. Sign out of banking, mail and cloud storage before you give an agent a task, or work in a second profile that is not signed in to anything.

On Brave the settings are worth a look, because the profile separation exists there and only needs to be switched on. Remove the password manager extension from the agent profile. Do not let the agent summarize a page full of third-party comments while something sensitive is open in another tab. And treat every confirmation prompt as what it is. It is the last point at which a human can still stop the process.

No vendor says whether the gap from the study is still open. Google announced an origin-based boundary in December 2025 and described it as a simpler version of origin gating that just tracks the read-writeable set. The part that would catch the described case had not shipped at the time of the test. There is no statement on whether it has shipped since. That is the question to put to the vendors before you leave your inbox open in the same browser.