The newest browsers don't just show you the web — they act on it. They read pages, fill forms, click buttons and remember everything, powered by AI agents riding along on your logged-in sessions. Convenient? Extremely. Security researchers spent the past year itemizing what it costs.
The quiet data harvest
Start with the numbers. Early-2026 research found 52% of AI-powered Chrome extensions collect at least one type of user data. Twenty-nine percent collect personally identifiable information. These tools occupy the most intimate seat software can hold — watching everything you read and type — and a meaningful share of them feed the data-broker economy. Every AI assistant bolted into a browser is a collection point until proven otherwise.
Why agents break the old rules
The deeper problem is structural. Traditional security assumes software does what its code says. Agents act on natural-language instructions — yours, or anyone's who can get words in front of them. A malicious instruction hidden in a webpage can read, to the agent, exactly like a command from you. Researchers call it indirect prompt injection. OpenAI has admitted the problem "may never be fully patched" in AI browsers, even as it ships mitigations like Lockdown Mode.
It gets worse. Agents inherit your authenticated sessions — when an agent browses, it browses as you. Logged into your email. Your bank. Everything. Independent reviews have caught agents executing hidden instructions, falling for scams, and slipping past safeguards on exactly those sensitive sessions.
The wall between websites is cracking
The web's most important boundary is the same-origin policy — the rule keeping one site out of another's data. In June, researchers showed agentic browsers can undermine it, pulling off cross-site data exfiltration through prompt injection and memory poisoning. Their proof-of-concept worked on ChatGPT Atlas; three other browsers showed exploitable conditions.
Memory poisoning deserves its own alarm bell. An agent with persistent memory can carry a planted instruction across sessions — executing it long after you've left the page that infected it. Stack on session hijacking and IP-based fingerprinting and you get a risk profile browsers have never faced, because no control layer can fully predict what a sentence will make an agent do.
What to do about it
You don't have to swear off AI browsing. You have to contain it.
Keep agents away from what matters most — banking, email and health logins belong in a separate browser or profile with no AI attached. Audit your extensions; remove AI tools you can't justify, since each one is a data collector by default. Kill persistent memory where you can, clear it where you can't. And treat "let the agent handle it" as what it really is: a permission grant.
The pitch says AI browsers act on your behalf. This year's research adds the fine print: with your keys, and not always on your side. The convenience is real. So is the exposure.
Image: via Pexels
