Notifications
Clear all
Topic starter
01/08/2026 8:57 pm
TL;DR: Chrome’s on-device Prompt API lets any page or extension drive local browser AI, and Mint showed that a single malicious comment could trigger bank transfers or tab-wide data exfiltration without a CVE, a malicious extension, or a bank compromise. The tool catalog, not the model, is the real security boundary, so browser agents need privilege scoping and explicit action controls.
NHIMG editorial — based on content published by Mint: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes.
Questions worth separating out
Q: What breaks when browser AI agents can act on untrusted page content?
A: The separation between reading data and executing actions breaks first.
Q: Why do local AI agents complicate identity and access management?
A: They can retain legitimate permissions while changing timing, prioritisation, and action sequence outside human presence.
Q: How do security teams know if an agentic browser is operating outside its intended boundary?
A: Look for unexpected page traversals, unapproved form submissions, unusual data movement, and actions taken outside the user’s normal workflow.
Practitioner guidance
- Scope browser AI to read-only use cases first Restrict browser agents to summarization, classification, or extraction tasks that cannot change state in authenticated applications.
- Apply per-origin and per-tab privilege boundaries Do not let every page reach the same model and tool set.
- Log model actions locally and centrally Capture prompt inputs, model outputs, and tool invocations on endpoints where browser AI is enabled so investigators can reconstruct what the agent saw and did.
What's in the full report
Mint's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step browser-agent architecture and tool-call sequence for the single-shot and ReAct models.
- The exact malicious comment flow used to trigger cross-tab banking actions and tab harvesting.
- Screenshots and video evidence showing the transfer modal and exfiltrated tab payloads.
- Chrome Prompt API and Chrome 148 release references used to ground the technical findings.
👉 Read Mint's analysis of Chrome Prompt API prompt-injection risks →
Chrome Prompt API and browser agents: are your controls keeping up?
Explore further
01/08/2026 9:04 pm
Browser AI agents are becoming a new identity boundary, not just a UX layer. Once a model can act inside an authenticated browser session, it inherits the user’s trust and access context without inheriting the controls that normally govern delegated access. That makes the browser agent behave like a non-human identity with broad runtime authority. The governance question is therefore not whether the model is helpful, but how its privileges are constrained across pages, tabs, and actions.
A question worth separating out:
Q: Who should be accountable when a browser agent exposes files or credentials?
A: Accountability should sit with the team that governs the delegated session, the identity permissions behind it, and the systems that allowed secret exposure or recovery changes. If an organisation lets an agent act inside a human session, then access review, PAM, and browser governance all share responsibility for the resulting blast radius.
👉 Read our full editorial: Chrome Prompt API exposes browser agents to indirect prompt injection
