AI attacks in the browser are redefining identity risk

At a glance

What this is: This is a Push Security analysis of how AI-driven attacks are shifting into the browser, where identity abuse, shadow AI, and poisoned tenant techniques converge.

Why it matters: It matters because IAM, NHI, and security teams increasingly need browser-level control and telemetry to govern human access, unmanaged identities, and AI-enabled interaction paths.

Context

AI attacks in the browser are a governance problem as much as a threat problem. The browser is now where humans, shadow SaaS, and AI apps intersect, which means identity risk is showing up in the place most organisations still treat as a user interface rather than a control point.

Push Security's analysis argues that blocking AI tools is not the same as governing their use. When employees route around policy through the browser, security teams lose visibility into the access path, the approval context, and the identity behind the session.

The article also frames the browser as the layer where attackers can exploit both identity abuse and AI-enabled automation. That makes browser telemetry, detection, and guardrails relevant across human IAM, non-human access paths, and emerging agent-driven workflows.

Key questions

Q: What breaks when AI attacks move into the browser instead of the endpoint?

A: Endpoint tools can miss the real abuse because the malicious step happens inside an authenticated browser session. That is where phishing, consent abuse, shadow AI use, and token-driven access can unfold while looking legitimate to perimeter controls. Security teams need browser telemetry and session-level enforcement to close that visibility gap.

Q: Why do AI browsers create new identity and access risk?

A: Because they turn the browser from a passive display layer into a system that can interpret content and execute actions. That collapses the distance between authentication, privilege use, and data movement. Existing IAM models assume a user or workload is behind the action. AI browsers weaken that assumption.

Q: What are the signs that shadow AI agents are escaping discovery controls?

A: Common signs include identity traces without formal registration, endpoint-level activity from local agents or MCP servers, and broad permissions with no clear owner. When those signals show up across SaaS, IDP, and EDR data but never appear in the central catalogue, discovery is failing. The symptom is fragmentation between where the agent acts and where governance can see it.

Q: How should teams govern trust infrastructure across machines and AI agents?

A: Treat cryptographic material as an identity estate, not a set of isolated configuration files. Assign ownership for issuance, renewal, revocation, and dependency mapping across platforms so keys, certificates, and trust chains are governed continuously rather than rediscovered during outages or expiry events.

Technical breakdown

Why the browser has become the control point for AI attacks

The browser now mediates access to SaaS apps, AI tools, and delegated identity flows, so it captures more of the real security story than endpoint tooling alone. Browser-native attacks bypass controls that only watch network traffic or managed devices, because the malicious action happens inside the authenticated session. That includes phishing, consent abuse, token theft, and shadow AI usage. Once the browser becomes the working environment, identity risk is no longer just about login events. It is about what the session can do after authentication and whether the organisation can observe and constrain that behaviour in real time.

Practical implication: treat the browser as an enforcement layer for session-level identity controls, not just a user interface.

How AI-enabled identity attacks change the abuse pattern

AI lowers the cost of scaling social engineering, but the more important shift is operational. Attackers can use AI to generate convincing lures, adapt content quickly, and automate repetitive identity abuse at session speed. Push Security also points to computer-using agents, which can act through browser interactions to perform steps that formerly required manual effort. That changes the defender problem from spotting a single suspicious login to governing many small, fast, and context-aware actions that look legitimate in isolation. The result is a larger attack surface inside normal browser workflows.

Practical implication: move detection from isolated login events toward behaviour and session telemetry inside the browser.

What poisoned tenants reveal about trust in AI collaboration spaces

A poisoned tenant attack exploits trust in the identity surface around AI collaboration tools. In the article's example, a fake organisation used a real company name to invite employees into a tenant, which shows how social engineering now rides on identity semantics, not just message content. The core weakness is that the user sees a plausible workspace boundary but lacks enough context to verify whether the tenant is genuine. That is an identity governance issue, because the security decision is made before traditional access controls ever see the risk. Browser visibility is what exposes the path into the tenant and the resulting interaction chain.

Practical implication: monitor tenant creation, invitation flows, and browser interactions that establish trust in AI collaboration environments.

Threat narrative

Attacker objective: The attacker wants to turn normal browser-based identity activity into a scalable path for account compromise, data access, or misleading AI collaboration trust.

1. Entry begins when attackers use AI-generated lures, phishing, or poisoned tenant invitations to pull a user into a browser-based interaction that looks legitimate.
2. Credential or session abuse follows when the user authenticates, grants access, or continues into an AI or SaaS workflow that the attacker can exploit.
3. Impact occurs when the browser session becomes the execution surface for identity abuse, shadow AI exposure, data loss, or account takeover.

Breaches seen in the wild

• Meta AI Instagram Account Takeover: 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Browser visibility is now an identity control, not a convenience feature. Once AI tools, SaaS access, and unmanaged usage converge in the browser, the organisation's blind spot is no longer the network perimeter but the live session. That means the control question changes from what users are allowed to log into to what they can do after authentication. Practitioners should treat browser telemetry as part of identity governance, not as an optional add-on.

Browser attacks expose the gap between policy and observed behaviour. Many programmes can define acceptable access, but cannot see when employees route around that policy through shadow SaaS or AI apps. The issue is not just policy non-compliance. It is that the security team loses the evidence needed to enforce policy in the first place. The implication is that governance must follow the path users actually take, not the path policy assumes they take.

Poisoned tenant trust is a named governance gap. A tenant invite can create legitimacy before any traditional control evaluates the relationship, which makes identity trust brittle in AI collaboration environments. The assumption that a named workspace boundary equals a trusted boundary breaks as soon as attackers can mint lookalike tenants and lure specific users into them. Practitioners need to rethink how trust is established in browser-mediated AI workflows.

AI-enabled attack scaling makes session-level defence more important than perimeter blocking. AI can accelerate phishing and identity abuse, but it also changes the tempo of attacker behaviour inside the browser. That means controls must be able to see, classify, and intervene on browser actions as they happen. Organisations that still rely on static awareness or post-event review will continue to miss the part of the attack that matters most: the authenticated session.

The identity programme now has to govern human, NHI, and shadow AI paths together. The article's central insight is that browser activity no longer maps neatly to one identity type. A person may be the visible user, a token may be the actual access vehicle, and an AI app may be the workflow destination. That cross-domain overlap is where governance will fail if teams continue to separate human IAM from NHI and emerging AI access paths. Practitioners should unify visibility across all three.

From our research library:

• Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
• 96% of security operations teams report critical blind spots, most commonly in cloud infrastructure (74%) and identity and access behaviour (67%).
• Read next: Ultimate Guide to NHIs — Key Research and Survey Results

What this signals

Browser-mediated identity has become the practical control plane for AI risk. Security teams should assume that the browser now carries more governance evidence than the endpoint or the network. When users can reach shadow AI, SaaS, and tenant invitations through ordinary sessions, the only reliable way to see the pattern is to instrument the browser path itself.

Session visibility is the new baseline for governing unmanaged access. Access reviews and policy documents cannot compensate for the fact that users may take unauthorised paths that never appear in central inventories. The programme needs evidence from the session layer, or it will keep governing the approved path while attackers and employees operate elsewhere.

For practitioners

• Instrument browser-level session telemetry Capture actions inside authenticated browser sessions so phishing, consent abuse, shadow AI usage, and tenant trust flows are visible before they become incidents.
• Govern shadow AI through the browser path Identify which AI tools employees reach through unmanaged browser flows, then compare that reality against approved access paths and policy.
• Monitor poisoned tenant patterns Watch for lookalike tenant creation, invitation sequences, and browser visits that establish false trust in AI collaboration spaces.
• Constrain account takeover blast radius Limit what authenticated browser sessions can reach after login, especially where identity tokens or unmanaged SaaS access can be reused across tools.

Key takeaways

• AI is reshaping identity risk by pushing more of the attack surface into the browser, where access, trust, and execution meet in a single session.
• The article's example of a poisoned tenant shows how attackers can weaponise workspace trust before traditional controls have a chance to evaluate the relationship.
• Practitioners need browser-level visibility and guardrails that cover human access, unmanaged identities, and AI-driven interaction paths together.

Key terms

• Browser-Mediated Identity Attack: A browser-mediated identity attack is any compromise path that uses the browser as the place where login, token issuance, consent, or session reuse happens. The browser is not the target software in this model; it is the operational surface where identity compromise is executed.
• Poisoned Tenant: A poisoned tenant is an attacker-created SaaS organisation or workspace that looks legitimate enough to lure a target into joining. The security risk comes from trust in the platform itself, because joining the tenant can open a path to data exposure, follow-on social engineering, or integration abuse.
• Session-level telemetry: Security data captured from inside the browser session, such as logins, clipboard events, file transfers, extension changes, and OAuth consents. It is more useful than alert-only reporting because it preserves the context needed to explain how identity and data risks developed.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.