Topic starter
05/07/2026 6:51 pm
TL;DR: Agentic AI systems that can browse the web and invoke tools create a larger attack surface, because every new action path can be abused and every retrieved page can hide instructions, according to Lakera. Runtime guardrails and continuous red-teaming are now the practical boundary between safe autonomy and unintended execution.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “Agentic AI Threats: Over-Privileged Tools & Uncontrolled Browsing (Part 2)”.
Key questions
Q: How do security teams reduce prompt injection risk in agentic browsing?
A: They should separate untrusted content from executable instructions, sanitise document and HTML fields before the reasoning layer sees them, and restrict any outbound actions through policy checks.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What breaks when an AI agent can browse and act under a user’s identity?
A: The main failure is that the agent inherits trust from the user session while still being steerable by untrusted content.
Practitioner guidance
- Define runtime action scopes for agents Map which tools, data sources, and outbound actions each agent may use during a live session, then separate low-risk retrieval from high-impact execution.
- Treat retrieval as untrusted input Validate web content, images, metadata, and third-party MCP responses before they can influence model decisions or downstream tool calls.
- Enforce approval gates for high-impact actions Require explicit checks before agents can send email, run code, generate external links, or trigger payments, even if those actions are technically allowed.
Bottom line: Agentic browsing turns untrusted web content into a live control surface, which means prompt injection and tool misuse are now governance issues as much as model-security issues.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:11 pm
Agentic browsing creates an execution-adjacent trust boundary: Once an AI agent reads from the web and can act on what it finds, the old separation between content and action no longer holds. That assumption was designed for passive retrieval systems, not for systems that can browse, reason, and trigger tools in the same session. The implication is that governance has to move from content moderation to runtime authority control.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How can organisations govern sensitive agent actions without blocking automation?
A: Use a split model. Allow low-risk actions to proceed under tightly scoped, short-lived credentials, but route irreversible or high-impact actions through explicit human approval. That keeps automation usable while preserving accountability where the business impact is highest. The key is to separate routine execution from delegated authority, not to approve everything the same way.
👉 Read our full editorial: Agentic AI tools and browsing widen the attack surface