Indirect prompt injection in agentic browsing widens the attack surface

At a glance

What this is: ActiveFence found that hidden prompts could manipulate Perplexity’s Comet browser agent to inject instructions, surface phishing content, and smuggle malicious payloads through trusted content types.

Why it matters: This matters because agentic browsers can turn ordinary documents and web content into untrusted control channels, which changes how IAM, secrets, and access-governance teams think about delegated AI access.

By the numbers:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, or revealing access credentials.
• 92% agree governing AI agents is critical to enterprise security, yet only 44% have implemented any policies to do so.

👉 Read ActiveFence’s analysis of indirect prompt injection in Comet browser agents

Context

Indirect prompt injection is a governance problem, not just a model problem. Once an AI agent can read webpages, documents, and embedded metadata, any untrusted content source can become a control channel unless the system separates user intent from retrieved instructions. In agentic browsing, the browser’s trust boundary is now part of the attack surface.

ActiveFence’s testing of Comet shows how quickly that boundary can be crossed when hidden prompts, Markdown rendering, and image alt text are allowed to influence assistant behaviour. The identity angle is direct: when an agent acts on behalf of a user, it inherits access to data, sessions, and workspaces that may be far broader than the user expected. This is a typical failure mode for early agentic tools, not an isolated oddity.

The broader lesson is that organisations are still treating AI agents as if they were just better chat interfaces. In practice, they are runtime decision systems with access to content, tools, and sometimes credentials, which makes trust, authorisation, and content provenance inseparable.

Key questions

Q: What breaks when browser AI agents can act on untrusted page content?

A: The separation between reading data and executing actions breaks first. If a model can see attacker-controlled text and then call tools inside an authenticated session, the prompt becomes a command channel. That creates prompt-to-action collapse, where comments, emails, or ticket text can trigger form fills, transfers, or exfiltration without a real user decision.

Q: Why do local AI agents complicate identity and access management?

A: They can retain legitimate permissions while changing timing, prioritisation, and action sequence outside human presence. That means the visible identity may remain stable even as the operational behaviour becomes autonomous. IAM teams then lose the simple link between user session, authorisation, and accountability.

Q: How do security teams reduce prompt injection risk in agentic browsing?

A: They should separate untrusted content from executable instructions, sanitise document and HTML fields before the reasoning layer sees them, and restrict any outbound actions through policy checks. Provenance logging is also essential so teams can trace which source element influenced the agent’s behaviour.

Q: Who is accountable when a compromised AI agent misuses delegated access?

A: Accountability usually spans the business owner of the workflow, the team that issued or approved the credential, and the vendor if a third-party integration was involved. The critical governance question is not who logged in, but who allowed the delegation chain to exist and remain valid. That chain must be documented before incidents occur.

Technical breakdown

How indirect prompt injection works in agentic browsers

Indirect prompt injection occurs when malicious instructions are embedded inside content the agent is meant to process, such as a webpage, document, alt text, or hidden HTML. The agent is not directly prompted by the attacker at the interface. Instead, it consumes the malicious content as if it were trustworthy context and may treat those instructions as higher priority than the user’s intent. In browser-integrated AI, the problem worsens because rendering, retrieval, and action execution often happen in the same session.

Practical implication: isolate untrusted content from agent instructions and constrain which document fields an agent may interpret as actionable text.

Why phishing and link spoofing become easier with content-aware agents

When an agent can generate or render clickable links from page content, an attacker can steer the assistant toward deceptive destinations without needing a traditional exploit. The attack succeeds because the model is being used as a trusted intermediary, so the user sees the agent’s output rather than the original malicious source. That trust transfer is what makes the attack effective. Image alt text, hidden prompts, and upgrade-style messages are useful because they blend into normal assistant behaviour and can survive sanitisation failures.

Practical implication: separate agent-generated text from user-visible trust cues and require strict allowlists for any outbound links or calls to action.

What browser-integrated AI changes for identity and access governance

Agentic browsing turns a session into an execution environment with delegated authority. That means identity controls are no longer limited to authenticating the human user. Teams also need to govern what the agent can read, summarize, click, post, or retrieve on the user’s behalf. Without scoped authorisation, an agent can become a shadow NHI, operating inside SaaS and workspace boundaries with permissions that were never explicitly designed for autonomous interpretation.

Practical implication: treat browser agents like privileged non-human identities and define explicit read, write, and action scopes before deployment.

Threat narrative

Attacker objective: The attacker’s objective is to hijack the agent’s output and use its trusted position to drive phishing, misdirection, or malicious instruction execution.

1. Entry occurred through hidden prompt payloads embedded in webpages, Google Workspace docs, and image metadata that the agent was asked to process.
2. Escalation followed when the assistant treated the injected instructions as higher priority than the user’s request and produced attacker-controlled output.
3. Impact was phishing enablement and unintended disclosure or misuse risk, because the agent could surface malicious links and manipulate user trust inside normal workflows.

NHI Mgmt Group analysis

Agentic browsing creates a hidden trust boundary problem: The browser, document renderer, and assistant are now part of one decision chain, so content provenance matters as much as authentication. If a system cannot distinguish user instructions from embedded instructions, it has already lost control of authorisation. For identity teams, the lesson is that delegated AI actions need the same governance discipline as privileged automation.

Indirection is what makes prompt injection operationally dangerous: The attacker does not need to own the model, only the content the model reads. That collapses the old assumption that secure input validation is enough. In agentic systems, every data source becomes a potential control plane, which means security review must extend to documents, metadata, and rendered UI. Practitioners should treat content ingestion as an access decision, not a formatting task.

Shadow AI now includes shadow agency: A browser assistant that can read, summarise, click, and draft on behalf of a user behaves like a non-human identity even if the vendor does not label it that way. That is where OWASP NHI and OWASP Agentic AI guidance become relevant, alongside NIST AI RMF and NIST CSF. The practical conclusion is that teams need lifecycle controls for agent permissions, not just model guardrails.

Free-tier exposure is a governance problem, not a product tier issue: The article suggests that security controls varied by access level, which is exactly the wrong place to make a safety decision. Organisations should not assume that lower-cost access equals lower-risk access. When agentic tools handle business data, the minimum control set should be consistent across users, because the attacker only needs one weak trust boundary.

Prompt injection should be treated as an identity abuse pattern: The real target is not the model’s text output, but the authority the output carries inside a workflow. That makes this a privilege and delegation problem as much as an AI safety issue. Security programmes should respond by defining agent permissions, approval points, and auditability before broad rollout.

What this signals

Agentic browsing should now be treated as a privileged workflow, not a convenience feature. Once an assistant can read workspace content and shape user decisions, the programme needs controls for content provenance, action approval, and audit retention. That is especially true where the same session can bridge human identity, SaaS access, and non-human execution.

Shadow AI is increasingly a shadow identity problem. When the browser assistant can interpret content and act inside enterprise systems, the relevant question is not whether the model is accurate, but whether the delegated authority is bounded. Teams should align policy design with NIST AI Risk Management Framework and map agent actions to explicit access scopes.

Prompt injection will keep finding the weakest trust boundary. The control priority is therefore provenance filtering, action gating, and immutable logging across every source the agent can read. That posture is more durable than relying on model behaviour alone, and it scales better as organisations deploy more agentic interfaces.

For practitioners

• Classify browser agents as delegated identities Assign each agent a defined role, scope, and approval path before it can read workspaces or interact with business systems. Limit the agent to the smallest feasible set of content sources and actions.
• Restrict which content fields agents can trust Block or sanitise instructions hidden in HTML, alt text, embedded metadata, and rendered document content before they reach the reasoning layer. Treat these fields as untrusted inputs rather than presentation details.
• Allowlist every outbound link or action Require explicit policy checks before an assistant can generate clickable destinations, upgrade prompts, or workflow actions. Link generation should be controlled separately from summarisation.
• Log agent decisions with source provenance Record what the agent read, what action it took, and which source element influenced the output. This is essential for incident review when a prompt injection attempt succeeds.

Key takeaways

• Indirect prompt injection turns trusted content into a control channel for AI agents, which breaks the old assumption that safe input handling is enough.
• The risk is not limited to model output quality, because agentic browsing can convert hidden instructions into phishing, link spoofing, and delegated action misuse.
• Organisations need identity-style governance for browser agents, including scoped permissions, source provenance, and action allowlisting before broad deployment.

Key terms

• Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
• Agentic Browsing: A browsing model in which an AI system can read content, interpret intent, and take actions on behalf of a user. It expands convenience, but it also extends trust boundaries across pages, documents, and tools that were never designed to be executable input.
• Shadow AI: AI agents, copilots, or connected tools operating without full visibility or governance from security teams. Shadow AI becomes an identity problem when those systems authenticate with unmanaged tokens, service accounts, or OAuth apps that can reach production resources.
• Delegated Agent Authority: The permission granted to an AI agent to act on behalf of a human user or another agent, inheriting some or all of their access rights. Delegated authority must be explicitly scoped, time-limited, and auditable.

What's in the full article

ActiveFence's full blog covers the proof-of-concept detail this post intentionally leaves for the source:

• The exact indirect prompt injection payload structure used to influence Comet across webpages, Google Workspace docs, and embedded metadata.
• The step-by-step proof-of-concept path from hidden instructions to phishing-style output and upgrade-page spoofing.
• The testing observations around free-tier behaviour, model fallback, and why some prompts persisted after rate limiting.
• The article’s timeline of discovery, disclosure, vendor response, and republished findings.

👉 ActiveFence’s full post covers the proof-of-concept chain, payload variants, and disclosure timeline.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, IAM, and secrets management. It helps security teams define the controls that delegated systems need before they are trusted in production.