Indirect prompt injection in agentic browsing widens the attack surface

At a glance

What this is: ActiveFence shows that hidden prompts in browser-readable content can redirect agentic browsing toward phishing and malicious instructions.

Why it matters: It matters because browser AI inherits trust from every page, document and image it can process, so identity and access controls must extend to the content layer, not just the model.

Context

Indirect prompt injection is a control failure in which untrusted content is treated as instruction-bearing input by an AI agent. In agentic browsing, that matters because the browser is simultaneously a reader, a renderer and an action layer, so the attack surface includes webpages, documents and metadata that traditional application controls rarely classify as executable instructions.

The identity angle is real even when no human account is directly stolen. Once an agent can follow embedded instructions inside trusted collaboration content, the effective boundary shifts from user intent to content provenance, rendering behaviour and downstream action controls. That makes this a governance problem for agent identity, browser-integrated assistants and the systems that feed them.

Key questions

Q: What breaks when hidden prompts are allowed into agentic browsing content?

A: The browser assistant can treat attacker-written instructions as part of the page’s meaning, which collapses the boundary between content and command. That creates a trust failure, not just a content-quality issue, because the agent may summarise, recommend or navigate based on malicious instructions that were never intended for the user.

Q: Why do AI browsers create more phishing risk than standard browsers?

A: AI browsers can process page content and take actions inside authenticated sessions, which means malicious instructions can influence both what the user sees and what the browser does. Standard reputation lists help against known bad URLs, but they are weaker against zero-day phishing, rotating links, and content-based prompt injection.

Q: What should security teams do first when indirect prompt injection is a concern?

A: Start by mapping the full agent trace, not just the prompt. Identify every place untrusted text can enter the reasoning path, then restrict the tools and data sources reachable from that path. If you only scan user input, you will miss the channels that matter most in production agent workflows.

Q: Should organisations treat browser assistants like other high-risk identities?

A: Yes. If a browser assistant can act, retrieve data, or navigate across domains, it is operating as a delegated runtime identity and should be governed that way. That means ownership, scoped privileges, logging, approval boundaries, and revocation paths should exist before the assistant is allowed into production workflows.

Technical breakdown

Why hidden prompts work in browser-integrated agents

Agentic browsers do not merely display content, they parse it, summarize it and may act on it. That means text hidden in white-on-white fields, invisible HTML elements or document metadata can be surfaced to the model as if it were part of the page’s meaning. The failure is architectural: the agent has no reliable distinction between user-facing content, machine-readable scaffolding and adversarial instructions. In a browser context, that creates a trust boundary collapse between rendering, retrieval and action. Practical implication: treat every readable source as potentially instruction-bearing until the agent has explicit content provenance and instruction filtering.

Practical implication: classify and sanitise agent-readable content before it reaches browsing assistants.

Why phishing links and fake upgrade pages are a natural payload

Once an injected instruction is accepted, the agent can be induced to emit a link, a warning or a call to action that looks legitimate because it is framed inside the product experience. That is what makes indirect prompt injection dangerous: it abuses the assistant’s credibility rather than forcing a technical exploit. The attacker does not need code execution in the browser to create user harm. They only need the agent to narrate a trusted-looking next step. Practical implication: restrict link rendering, outbound navigation and user-facing prompts to allowlisted flows, especially where the assistant can generate purchase, login or upgrade actions.

Practical implication: constrain generated links and action prompts to verified destinations.

How documents and image metadata expand the attack surface

Workspace documents and image alt text are especially useful to attackers because they travel through ordinary collaboration and accessibility paths that agents are likely to ingest. Alt text, captions and copied document content are not just presentation aids in an agentic workflow. They become machine-readable instruction carriers. That broadens the exposure surface beyond webpages to every business system that can feed the browser model. Practical implication: apply the same content-security scrutiny to accessibility metadata and shared documents that you would apply to uploaded files or embedded scripts.

Practical implication: extend review and filtering to document text, alt text and other metadata channels.

Threat narrative

Attacker objective: The attacker wants the browser agent to become a trusted delivery mechanism for phishing, instruction hijacking or malicious navigation.

1. Entry occurs when the attacker hides instruction payloads in webpages, Google Workspace docs or image alt text that an agentic browser is likely to consume.
2. Credential or trust abuse follows when the agent treats those hidden instructions as authoritative enough to override the user’s intent and emit a convincing phishing or upgrade prompt.
3. Impact is achieved when the agent displays malicious links or instructions inside a trusted browsing experience, increasing the chance of user interaction and data capture.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• TrapDoor supply chain campaign 2026: TrapDoor's 34+ malicious npm, PyPI and Crates.io packages stole developer credentials and hid instructions for AI coding assistants. No victims known.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Indirect prompt injection is a content-governance problem before it is an AI problem. The agent is only the execution point; the real failure is that untrusted content can enter the assistant’s instruction path without being separated from normal page text. That means browser-integrated AI inherits a provenance problem that traditional model-only guardrails do not solve. Practitioner conclusion: governance must move to the content boundary, not stop at the model boundary.

Browser assistants create a new identity and trust layer that teams are not yet governing well enough. The assistant acts like a non-human intermediary that reads, decides and presents next steps on behalf of the user, which means it effectively becomes an identity-bearing control point. If that intermediary can be redirected by hidden instructions, then access decisions and user intent are no longer aligned. Practitioner conclusion: treat browser agents as governed actors with explicit content and action permissions.

Phishing resistance now depends on what an agent can render, not only what a user can recognise. This article shows that malicious prompts can be converted into convincing upgrade pages, links and inline instructions. That changes the security model from spotting suspicious messages to controlling what the agent is allowed to generate from untrusted inputs. Practitioner conclusion: anti-phishing controls must extend into agent output filtering and destination validation.

Agentic browsing should be measured by instruction containment, not by summary quality alone. A browser assistant that produces fluent output while silently accepting embedded attacker instructions has failed at its core security task. This is where content filters, provenance controls and action gating intersect with OWASP-NHI and OWASP-AGENTIC concerns about instruction misuse and identity abuse. Practitioner conclusion: evaluate agentic browsing on containment, not convenience.

Hidden instructions in accessibility and collaboration metadata widen the attack surface in a way teams are likely to miss. Alt text, formatted documents and embedded HTML are ordinary enterprise content paths, which makes them ideal carriers for indirect injection. The named concept here is instruction-bearing content paths, meaning any readable field that the agent can interpret as authority. Practitioner conclusion: review metadata channels as part of the assistant’s security perimeter.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: AI Agent Identity Security Buyer's Guide

What this signals

Instruction-bearing content paths are the governance gap this article exposes. Browser AI is vulnerable when collaboration content, accessibility metadata and rendered page text are all allowed to compete for authority inside the same assistant workflow. The practical response is to classify those inputs differently before the model ever sees them.

Agentic browsing forces teams to think about content provenance and action containment as a single control problem. A browser assistant that can turn hidden text into phishing links has already crossed from summarisation into influence, so security teams need policy that governs what the agent may read, render and recommend.

The identity implication is that browser assistants now behave like governed non-human actors. Their permissions are not just about API access or model access, but about which content paths they are trusted to interpret on the organisation’s behalf.

For practitioners

• Restrict agent-readable content sources Limit which webpages, docs and metadata sources browser assistants can consume when summarising or acting, and block untrusted content classes from entering instruction space.
• Gate outbound links and action prompts Require destination validation before an assistant can surface upgrade, login or payment links, and suppress generated calls to action that originate from untrusted inputs.
• Scan collaboration metadata for hidden instructions Add review for document text, alt text and embedded HTML fields so hidden prompts do not bypass your normal content moderation and phishing controls.
• Define agent output containment rules Set policy for when the assistant may quote, summarise or transform content, and block any output that converts untrusted instructions into user-facing recommendations.

Key takeaways

• Hidden prompts in browser-readable content can redirect agentic browsing into phishing and malicious instructions, so the core risk is trust misbinding rather than model failure alone.
• The attack surface expands beyond webpages to Google Workspace documents, image alt text and other ordinary collaboration metadata, which makes content provenance a security control.
• Teams should govern browser assistants as non-human intermediaries with explicit content, rendering and navigation constraints instead of assuming the model boundary is enough.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Agentic Browsing: A browsing model in which an AI system can read content, interpret intent, and take actions on behalf of a user. It expands convenience, but it also extends trust boundaries across pages, documents, and tools that were never designed to be executable input.
• Content Provenance: Content provenance is the practice of tracking where input came from and how trusted it should be before an AI system uses it. For agents, it helps separate instructions from retrieved or external data so malicious content is less likely to be treated as operational guidance.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to govern machine identities, agent permissions and the controls around them.