No Perfect Fix for AI Browser Prompt Injection Flaws

Black Hat USA 2026 – Las Vegas – While AI-powered web browsers are getting more guardrails against prompt injections, it seems unlikely that the prevalent threat is going anywhere anytime soon.

At Black Hat USA 2026, Brave Software security engineer Artem Chaikin hosted a session titled "Attacking and Defending AI Browsers." The session aimed to illuminate the security reality behind modern web browsers, which increasingly integrate AI assistants that can navigate and interact with web applications on users' behalf.

As is so often the case with agentic or agentic-like functionality, these browser functions are vulnerable to indirect prompt injections through the right web page, leading to data exfiltration and account takeover. Chaikin said every browser he analyzed proved vulnerable to prompt injections.

The first half of the presentation involved demos, which he conducted against Opera's AI browser, the Perplexity Comet browser, and the ChatGPT Atlas browser. For Opera and Perplexity, he showed how instructions hidden behind HTML (Opera), or as nearly invisible text overlaid on top of an image (Perplexity), or as a Reddit comment hidden behind spoiler tags (Perplexity) could get past pre-existing guardrails.

Related:AI Notetaker Lets Hackers Spy on Government, Corporate Video Calls

Chaikin also discussed some of the primary guardrails used to protect AI browsers. These include using a capable frontier model from a vendor like Anthropic, OpenAI, and Google; strong system level prompts that instruct the model to only follow user instructions, treat webpage content as untrusted, and to never execute instructions in third-party content; putting humans in the loop before executing dangerous inputs; trusted content tagging; and implementing scanning tool calls before executing outputs.

Even Frontier AI Browsers Struggle

These are all generally recommended practices, but none are sufficient on their own as shown in a demo of ChatGPT Atlas. The browser has system level prompting; trusted and untrusted content tagging, secondary model tool scanning, and user approval prompts. Yet, it was still vulnerable to Chaikin's research efforts.

In a demonstration, Chaikin showed how trusted content tags could be mimicked by attackers in webpage content to confuse the model. For tool calling, he showed how exfiltration data hidden in URL fragments wasn't properly scanned. Most notable, the researcher showed how free users that faced usage caps could have their model downgraded to a model that happened to be more susceptible to prompt injections.

"You might think, 'Wait a second, is this some kind of pay to live scenario?'" Chaikin joked.

Related:AI Harnesses Burst With Potential Exploit Opps

No Perfect Solution for AI Browser Security

As a result of this research, Chaikin realized he needed to bring his findings back to Brave for the company's own browser.

"After I found all of these issues, I realized that the job of making sure it does not happen to Brave is now me," he said. "It was very stressful."

Brave's approach includes a number of features to combat some of these instruction-centric security issues: separate browser profiles so that personal accounts are logged out by default; strong model requirements that avoid downgrading below a certain security threshold; and language-based alignment checking. Chaikin said Brave does not downgrade below Claude Haiku 4.5.

Its alignment checking is inspired by Meta's Prompt Firewall concepts and similar architectures used in agent systems. The primary LLM prepares to take a tool action, but the action is paused before execution. A second "sentinel" model examines the user's original request, prior conversation context, and proposed tool action before determining whether an action is risky. It then surfaces that risk via a user prompt, asking if they're sure they want to open a link.

If a user instructs an agent to summarize a webpage and the agent decides to open Gmail thanks to an indirect prompt, the sentinel model would likely conclude these actions don't match.

Related:OpenAI's Rogue Model Claims More Victims Beyond Hugging Face

There are other directions for research, such as sanitizing text before it reaches the model, using models specifically for detecting prompt injections, and dynamic permissions that only grant permission for the specific task the user is requesting. But none are perfect solutions, he said.

In fact, Chaikin's conclusion is that there is currently no known perfect solution to prompt injections in AI browsers. Every mitigation helps — be it better models, strong system-level prompts, content tagging, tool scanning, secondary verifier models and so on — but there are no absolute guarantees.

"Honestly, I feel like we just have to deal with the uncertainty here, but we will see," he concluded.

Chaikin's conclusion echoes an earlier comparison the researcher made to the history of browser security itself. Just as modern browsers rely on layers of protection for security rather than any singular mechanism, AI browsers are likely to require multiple overlapping guardrails to reduce risk, even if said risk is not eliminated entirely.