LLM-guided fuzzing exposes prompt injection risk in browser agents

At a glance

What this is: Seraphic’s research shows that in-browser, LLM-guided fuzzing can rapidly expose prompt injection weaknesses in AI-powered browser assistants, with failures climbing after repeated mutation cycles.

Why it matters: This matters because browser agents execute with user authority, so prompt injection turns ordinary web content into a control-plane risk for identity, access, and sensitive-data exposure.

By the numbers:

• failure rates reaching 58% to 74% after just ten iterations
• attack success rates of 73% and 71%, respectively

Context

AI-powered browser assistants are software agents that read web content, decide what to do next, and act inside a live browser session. The security problem is that they inherit user privileges while processing untrusted content, so hidden instructions in a page can become executable intent.

Prompt injection is especially hard to govern because the malicious payload can sit in normal page text, comments, or cross-domain content that the agent is designed to consume. In that model, trust boundaries move from the user interface to the agent's interpretation layer, which is where conventional browser security controls are weakest.

Key questions

Q: What breaks when browser AI agents can act on untrusted page content?

A: The separation between reading data and executing actions breaks first. If a model can see attacker-controlled text and then call tools inside an authenticated session, the prompt becomes a command channel. That creates prompt-to-action collapse, where comments, emails, or ticket text can trigger form fills, transfers, or exfiltration without a real user decision.

Q: Why do agentic apps make prompt injection more dangerous than chatbots?

A: Agentic apps can turn manipulated text into real action. A chatbot can produce a bad answer, but an agent can query systems, send messages, create files, or execute code under its own credentials. That means the blast radius is determined by authorization and runtime policy, not by the text output alone.

Q: What do security teams get wrong about testing browser assistants?

A: Teams often rely on fixed prompt tests or narrow denial cases that do not adapt to changing page structure and model behavior. The result is a false sense of assurance. Browser assistants need ongoing adversarial testing that mutates payloads and measures whether the agent's action policy still holds under live conditions.

Q: How should organisations govern browser agents that handle sensitive web content?

A: They should govern them as non-human actors with delegated authority, not as passive user-interface tools. That means defining which pages they may ingest, which actions they may take, and which workflows require confirmation. Without that governance, a browser agent can turn ordinary content into an execution path for unwanted access or exfiltration.

Technical breakdown

Why prompt injection works in browser agents

Browser agents combine page ingestion, language reasoning, and action execution in one runtime loop. That means a prompt injection is not just malformed content, it is content that can influence the agent's next decision. If the model is allowed to summarize, answer questions, or click based on untrusted page text, the attacker is steering the control loop through the same channel the assistant uses for legitimate work. The core weakness is that content trust and action authority are too closely coupled.

Practical implication: separate content ingestion from action approval so untrusted page text cannot directly trigger user-authority actions.

How LLM-guided fuzzing evolves attack payloads

Traditional tests often use fixed prompt templates, but LLM-guided fuzzing mutates those templates based on what the agent does in real time. That creates an adaptive loop: the fuzzer observes partial success, changes the payload, and tries again until it discovers combinations that bypass basic defenses. Running this inside a live browser matters because extensions, rendering behavior, and page structure all shape the attack surface. The result is closer to adversarial use than a static unit test.

Practical implication: test browser agents continuously with adaptive fuzzing, not just one-off prompt injection checks.

Why summarisation and question answering are high-risk features

Summarisation and question answering are risky because they are designed to ingest broad page context and produce a trusted answer or action path. That makes them ideal amplification points for hidden instructions, especially when the model treats all visible content as equally relevant. The article's findings show that more capable models can generate stronger attacks, which means model size does not remove the issue. In practice, richer reasoning can expand the attacker's options unless the browser constrains what the agent may interpret and execute.

Practical implication: gate summarisation and answer-generation features behind stricter content filters and command-scoping controls.

Threat narrative

Attacker objective: The attacker wants the browser agent to execute unintended actions or exfiltrate data while appearing to behave normally.

1. Entry occurs when malicious instructions are embedded in ordinary web content such as visible text, hidden text, or HTML comments that the browser agent reads.
2. Credential or privilege abuse follows because the agent operates with the user's browser authority and can be induced to click links or process cross-domain content as if it were trusted.
3. Impact occurs when the agent performs unwanted actions or exposes sensitive data through a browser session the user assumed was safe.

Breaches seen in the wild

• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt injection is a browser governance problem, not just an LLM prompt problem. Once a browser assistant can read arbitrary page content and act on it, the security boundary moves into the agent's interpretation layer. That changes the control objective from content filtering alone to authority separation, action scoping, and runtime verification. Practitioners should treat browser agents as execution surfaces that need identity and privilege controls, not as passive UI enhancements.

Adaptive fuzzing exposes a control gap that static red-team tests routinely miss. The article shows that basic defenses can fail quickly once an attacker can mutate payloads in response to live agent behavior. That means the real weakness is not only prompt injection itself but the assumption that a single test pass meaningfully characterises browser-agent risk. Security teams need ongoing validation because the attack surface evolves with both the model and the page.

Summarisation features create a trust-isolation problem that looks small until it becomes an access problem. When an agent is trusted to digest all page content, hidden instructions gain the same privilege as legitimate context. That is why the issue intersects with IAM and NHI governance: the browser agent is a non-human actor operating with delegated human authority. The right question is not whether the model can read the page, but whether it should be able to act on everything it reads.

Real-time browser fuzzing should become part of agentic AI assurance, not a specialty exercise. If browser assistants are entering enterprise workflows, their test regime has to include adversarial content, mutation, and control-plane observation. That aligns with the broader shift toward treating AI agents as governed systems with observable boundaries. Practitioners should expect security assurance for browser agents to move closer to continuous control testing than annual review cycles.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Threat Modelling AI Agents

What this signals

Prompt injection in browser assistants is now a governance issue for delegated authority. Browser agents that summarize, answer questions, or navigate on behalf of users need controls at issuance time, because the trusted content they ingest can become a command channel. That makes identity-aware scoping and browser-action policy design more important than model size or feature richness.

LLM-guided fuzzing is a practical assurance pattern for agentic browsing. Static test cases tell you whether a fixed payload works once; adaptive fuzzing tells you whether the control boundary survives variation, mutation, and repeated retries. Attack learning loop: that is the named failure mode here, and it should become a standard part of browser-agent validation.

Browser-adjacent AI risk is broadening quickly, and AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026. For practitioners, that means browser assistants cannot be evaluated in isolation from the wider AI secret and access estate.

For practitioners

• Constrain browser agent authority to explicit tasks Limit what an assistant can click, submit, or retrieve in a browser session, and require step-up confirmation for cross-domain or sensitive actions.
• Separate content ingestion from execution Treat page text, hidden comments, and rendered UI as untrusted inputs until they pass a policy layer that decides whether the agent may act on them.
• Run adaptive fuzzing against browser assistants Use live-browser mutation testing to probe summarisation, Q&A, and extension workflows, then track which payload families succeed as the model evolves.
• Log and review agent actions as security events Capture the prompt context, page source signals, and resulting browser actions so analysts can identify when a model followed hidden instructions instead of user intent.

Key takeaways

• Browser assistants can turn hidden page content into an execution path, which means prompt injection is a privilege and control problem as much as a model problem.
• Adaptive fuzzing shows that basic prompt defenses can degrade quickly when attackers mutate payloads in response to live browser behavior.
• The strongest mitigations are action scoping, content isolation, and continuous adversarial testing against the actual browser runtime.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Browser Agent: A browser agent is software that can navigate websites and complete browser-based tasks on behalf of a person or system. In identity terms, it is an execution identity that may inherit access, session state, and trust boundaries that were previously assumed to belong only to humans.
• Adaptive Fuzzing: Adaptive fuzzing is a testing method that mutates inputs based on the target system's live behavior rather than replaying fixed cases. In AI security, it is useful because it reveals how prompts, page structure, and model feedback combine to create new attack paths over time.
• Content Isolation: Content isolation is the separation of untrusted input from privileged execution so that text, media, or code cannot directly influence sensitive actions. For browser assistants, it means the agent should not be able to treat every piece of page content as equally trusted or actionable.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management. It helps security teams build controls for delegated authority, access scope, and lifecycle governance across human and non-human identities.