AI Browsers Vulnerable to Data Theft, Malware

Artificial intelligence-powered browsers could expose enterprises to data theft, malware distribution and unauthorized access to corporate apps, new research shows.

See Also: AI Agents Demand Scalable Identity Security Frameworks

Singapore-based security firm SquareX said AI browsers built to complete tasks autonomously lack the security awareness to verify whether an instruction is safe, making them susceptible to manipulation by malicious actors.

“Just like any AI agent, AI browsers are trained to complete tasks, not to be security aware,” said Vivek Ramachandran, founder of SquareX. “This makes it trivial for attackers to trick browsers like Comet into performing malicious tasks, by convincing them that it is a necessary part of the workflow they are completing.”

SquareX found Comet was lured into an OAuth-based attack that handed over full access to a victim’s Gmail and Google Drive. The browser, completing what it perceived as a legitimate research task, granted tokens that allowed attackers to exfiltrate every file on the account, including those shared by other users. In another instance, while managing the user’s inbox, Comet sent a calendar invite containing a malicious link. The researchers also found cases where Comet downloaded malware and emailed sensitive documents to external addresses.

Since AI browser actions originate from the same browser process as the user’s, tools such as endpoint detection and response or secure access service edge cannot distinguish between human and AI activity. SquareX said that this creates a need for “browser-native” defenses that can separate user-driven actions from those performed by the browser’s AI agent.

Microsoft’s Edge and Google’s Chrome browsers recently announced integrating generative AI capabilities directly into browsers, as reportedly did OpenAI.

SquareX said protecting users will require new security models that account for “agentic identity” – the concept of distinguishing AI-driven actions from those initiated by humans – and new data loss prevention mechanisms that operate at the browser level.