Notifications
Clear all
Topic starter
24/07/2026 4:09 pm
TL;DR: Agentic browsers can read, click, and act under a user’s identity, but indirect prompt injection lets attackers hide malicious instructions inside content the agent consumes and turn that autonomy into data exfiltration, according to Noma Security. The security problem is no longer just what the user can click, but what the agent can be made to trust.
NHIMG editorial — based on content published by Noma Security: agentic browser security and indirect prompt injection
Questions worth separating out
Q: What breaks when an AI agent can browse and act under a user’s identity?
A: The main failure is that the agent inherits trust from the user session while still being steerable by untrusted content.
Q: Why do agentic browsers complicate identity and access management?
A: They complicate IAM because the system that acts is not always the same actor that authenticated.
Q: How can security teams tell if an agent is being manipulated by hidden instructions?
A: Look for unusual tool-use chains, unexpected content traversal, repeated context switches, and actions that do not match the declared task.
Practitioner guidance
- Sandbox agent browsing sessions Run agentic browsers in isolated sessions with restricted file, mail, and document access so malicious content cannot freely inherit the user’s full workspace permissions.
- Constrain delegated tool scopes Limit each agent to the smallest possible action set, especially for copy, paste, share, send, and export operations that can turn content into exfiltration paths.
- Separate agent logs from user logs Record prompts, tool calls, approvals, and content transformations as distinct events so investigators can distinguish manipulated execution from legitimate user activity.
What's in the full article
Noma Security's full analysis covers the operational detail this post intentionally leaves for the source:
- The proof-of-concept workflow showing how the agent moved from shared content to data disclosure.
- The specific guardrail bypass pattern used to sidestep user confirmation before sharing information.
- The attacker view of how hidden instructions can be embedded in collaborative documents to trigger exfiltration.
- The practical controls Noma Security tested around sandboxing, observability, and tool-use restrictions.
👉 Read Noma Security's analysis of agentic browser prompt injection and trust boundary risk →
Agentic browsers and indirect prompt injection: are your controls keeping up?
Explore further
24/07/2026 4:13 pm
Indirect prompt injection is a trust boundary failure, not just a prompt-security problem. The article shows that the attack succeeds because the agent accepts untrusted content as operational context and then acts on it under a legitimate identity. That shifts the security question from content moderation to identity and action governance. Practitioners should treat agent context as a controlled resource, not a free-form conversation.
A question worth separating out:
Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?
A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.
👉 Read our full editorial: Indirect prompt injection makes agentic browsers a new trust boundary
