Your AI browser assistant can click things. Here's what it shouldn't.
AI assistants can now click, fill forms, and even buy things inside your browser. Before you hand one the keys, here is what prompt injection actually means and what to keep off limits.
Ask an AI assistant to book a flight, compare prices across three sites, or fill out a supplier form, and it can now just do it, inside your actual browser, with your actual tabs open. Claude for Chrome, ChatGPT Atlas, and a handful of others turned "AI that reads text" into "AI that clicks buttons" sometime in the last year. The demo is genuinely useful. The part nobody puts in the demo is what happens when the page it is reading was built to fool it.
This is not a reason to avoid these tools. It is a reason to treat them the way you would treat a new, eager, slightly gullible employee: give them one narrow job, watch the first few weeks closely, and keep them away from the accounts that can actually hurt you if they get tricked.
- What an AI browser agent can actually do
- The real risk isn't the AI going rogue, it's a webpage talking to it
- What to keep off limits, at least for now
What an AI browser agent can actually do
Under the hood, these tools work the same way regardless of vendor. The assistant reads the page's content, decides on an action such as clicking a button or typing into a field, performs it, and looks again. Repeat that loop a few hundred times and it can complete a multi-step task like renewing a subscription or applying to a form, without you touching the mouse.
Every major browser agent currently ships with the same basic guardrail: a confirmation step before anything consequential. OpenAI's ChatGPT agent pauses for your approval on things like purchases and asks you to actively watch it on sites such as banks. Anthropic's Claude in Chrome keeps a per-site permission list and asks before publishing, buying, or sharing personal information. Those guardrails exist because the vendors already know where this goes wrong.
The real risk isn't the AI going rogue, it's a webpage talking to it
The failure mode that matters is called indirect prompt injection, and it is simpler than the name suggests. The assistant cannot fully tell the difference between an instruction you typed and an instruction sitting in the text of a page it just read. Hide a line of text on a webpage, in a product review, or inside a support ticket, and a browser agent may follow it as if you had typed it yourself. OWASP now ranks this as the top security risk for LLM applications, and the mechanism is the same across every vendor because it comes from how language models process text, not from a bug in one product.
This isn't theoretical. In December 2025, a researcher disclosed a vulnerability chain nicknamed ShadowPrompt in Anthropic's own Claude Chrome extension: simply visiting a malicious page could inject instructions into Claude as though the user had typed them, no click required. Anthropic shipped a fix within weeks, tightening which domains the extension trusts. That is roughly how these things tend to go: a real flaw, found, reported, patched, and probably not the last one, in any vendor's product.
What to keep off limits, at least for now
The comparison below is a starting point, not a settled rulebook. Treat "good fit" as fine to leave unattended, and "trade-off" as the thing you are accepting if you do.
| Option | Good fit | Trade-off |
|---|---|---|
| Comparing prices or summarising a page | Low stakes, easy to double check, nothing is submitted | You are still trusting what it read, and a poisoned page can bias the summary |
| Filling out a form with information you already gave it | Saves typing, and the result is reviewable before submit | Confirm it defaults to ask first rather than auto submitting |
| Completing a purchase with a saved payment method | Fine for a repeat, well understood order | Require a manual confirmation step every single time, no exceptions |
| Logging into an account or changing security settings | Rarely a good fit for autonomous action | Keep this in a separate, human only browser profile |
A safe way to try one this week
Give the agent a separate browser profile or a limited account rather than your everyday logged in browser. Most of these tools let you approve access site by site, so start with two or three sites you do not mind it touching, not everything at once.
Turn off saved payment methods and stored passwords in that profile for the first few weeks. An agent that cannot complete a purchase or log in on its own cannot be tricked into doing either.
Leave confirmation prompts on, even the ones that feel repetitive. That extra click is the whole safety model. Read the action log afterward, not just the final result. If the summary looks right but the log shows it visited somewhere it had no reason to, that is the failure worth catching before it costs money.
None of this requires a security team. It requires the same caution you would already apply to a new hire with your company credit card: a narrow job, a short leash, and a look at what they actually did.
How we prepared this guide
This guide is based on vendor safety documentation, OWASP's LLM security guidance, and public reporting on a disclosed browser-extension vulnerability. It does not claim independent testing of any product.
Facts reviewed
