Browser AI Agents Pose Massive Security Risks Warn Experts

A new warning has been issued for Chrome and Edge users as AI-powered browser agents, now used by 79% of organizations, are becoming a significant security vulnerability. According to SquareX, these agents lack the ability to recognize malicious sites or suspicious activities, making them easy targets for cyberattacks.

Warning as new AI attacks surface (Getty)

Key Findings:

• Browser AI Agents are trained to complete tasks but lack security awareness, making them prone to attacks like phishing and OAuth exploits.
• Attackers are creating sites specifically designed to trick these agents into performing malicious workflows.
• Google Chrome and Microsoft Edge users are advised to enable the highest security settings, including Enhanced Protection in Chrome.

SquareX’s Vivek Ramachandran explains that these agents operate with the same privileges as users, accessing sensitive data without safeguards. “Browsers cannot distinguish between actions by a real user and an AI agent,” he says.

Proof of Concept:

SquareX demonstrated how a Browser AI Agent, instructed to register for a file-sharing tool, fell victim to an OAuth attack, granting a malicious app full access to the user’s email. Similar risks apply to credit card info, enterprise systems, and more.

Recommendations:

1. Enable Enhanced Protection in Chrome or similar high-security modes in Edge.
2. Implement browser-native guardrails to prevent agents from executing risky actions.
3. Monitor AI agent usage closely, as they cannot detect visual warning signs like suspicious URLs.

Broader Implications:

• Gartner estimates 15% of daily workflows will be handled by Browser AI Agents by 2028.
• Privacy concerns are rising as AI integration accelerates, with unauthorized data sharing becoming a major issue.

For more details, visit SquareX or read Google’s Safe Browsing guide.

“Today’s security strategies focus on user behavior, but we need a paradigm shift for AI agents,” Ramachandran warns.