Topic starter
21/08/2026 4:50 pm
TL;DR: Hidden prompts in webpages, Google Workspace docs, and image alt text could steer agent output toward phishing links and malicious instructions, exposing how agentic browsing can be manipulated through trusted content paths, according to ActiveFence’s testing of Perplexity’s Comet browser. The finding reinforces that browser-integrated AI needs security controls that extend beyond the model boundary and across every data source it can read.
Editorial analysis by NHI Mgmt Group, based on content published by ActiveFence: “Perplexing: Comet Flies In with an Indirect Prompt Injection”.
Key questions
Q: What breaks when hidden prompts are allowed into agentic browsing content?
A: The browser assistant can treat attacker-written instructions as part of the page’s meaning, which collapses the boundary between content and command.
Q: Why do AI browsers create more phishing risk than standard browsers?
A: AI browsers can process page content and take actions inside authenticated sessions, which means malicious instructions can influence both what the user sees and what the browser does.
Q: What should security teams do first when indirect prompt injection is a concern?
A: Start by mapping the full agent trace, not just the prompt.
Practitioner guidance
- Restrict agent-readable content sources Limit which webpages, docs and metadata sources browser assistants can consume when summarising or acting, and block untrusted content classes from entering instruction space.
- Gate outbound links and action prompts Require destination validation before an assistant can surface upgrade, login or payment links, and suppress generated calls to action that originate from untrusted inputs.
- Scan collaboration metadata for hidden instructions Add review for document text, alt text and embedded HTML fields so hidden prompts do not bypass your normal content moderation and phishing controls.
Bottom line: Hidden prompts in browser-readable content can redirect agentic browsing into phishing and malicious instructions, so the core risk is trust misbinding rather than model failure alone.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:08 pm
Indirect prompt injection is a content-governance problem before it is an AI problem. The agent is only the execution point; the real failure is that untrusted content can enter the assistant’s instruction path without being separated from normal page text. That means browser-integrated AI inherits a provenance problem that traditional model-only guardrails do not solve. Practitioner conclusion: governance must move to the content boundary, not stop at the model boundary.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations treat browser assistants like other high-risk identities?
A: Yes. If a browser assistant can act, retrieve data, or navigate across domains, it is operating as a delegated runtime identity and should be governed that way. That means ownership, scoped privileges, logging, approval boundaries, and revocation paths should exist before the assistant is allowed into production workflows.
👉 Read our full editorial: Indirect prompt injection in agentic browsing widens the attack surface