Browsers that act for you are standard equipment now. Chrome, Atlas, Comet and the rest will happily fill a form, compare prices or work a checkout while you get on with something else. The convenience is real — and so is a security problem the people building these things openly admit they can''t fully fix.
Here''s how to use one without handing over more than you meant to.
Know what the risk actually is
The danger isn''t that the AI misunderstands you. It''s prompt injection: hidden instructions buried in content the agent reads, which it then follows as if you had typed them yourself.
Those instructions can sit anywhere the agent looks — page text, an embedded document, an ad, a script. Researchers have caught this happening on the open web, not just in test conditions. And the ceiling is higher than a wrong answer: one team showed that a vulnerable path in an agent framework could turn a single prompt into code running on the host machine, with no exploit or malicious attachment anywhere in the chain.
Browsing agents make appealing targets for an obvious reason. They read untrusted content all day, and they can act — fill forms, download files, submit payments.
Step 1: Keep the agent away from your real accounts
This is the single highest-impact move, and security people consistently put it first. Privilege separation just means the agent doesn''t work inside the session that holds your life.
In practice: run agent tasks in a separate browser profile signed into as little as possible. Keep your main mail, banking, health and work accounts in a profile it never touches. If a task needs a login, sign in for that task and sign out when it''s done.
Step 2: Don''t leave payment sitting there
Don''t store card details in the profile the agent uses. If a job ends in a purchase, let it do the research and fill the cart, then pay yourself.
Google''s own documentation for Chrome''s auto browse says the feature is experimental, that it can act unexpectedly — including completing a purchase without permission — and that its safeguards don''t guarantee protection against every risk. Believe the vendor.
Step 3: Actually read the confirmations
Every serious agent stops before sensitive actions and asks you to approve. Those checkpoints are your last line of defence, and they only work if you read them instead of tapping through on autopilot.
What to look for: does the action described match what you asked for? Injected instructions usually give themselves away as a step with no connection to your request — a message going out, a file downloading, a form submitting somewhere odd.
Step 4: Keep tasks small
Give the agent errands with a clear finish line. "Compare these four products and summarise" is a good task. "Manage my subscriptions" is an open invitation to wander somewhere you hadn''t considered.
Short tasks also just work better. Long-running jobs tend to time out or drift off course regardless of security.
Step 5: Watch the first few runs
Before you trust an agent with anything that matters, sit through three or four low-stakes tasks start to finish. You''re watching for how it behaves when a page does something strange, and how reliably it asks before acting.
The honest version
Nobody has solved prompt injection, and the vendors say as much. What you can control is blast radius — what the agent can reach, what it can spend, how much of your life lives in the session it runs inside. Get those three right and an agent that gets fooled costs you an afternoon instead of an account.
Image: Dan Nelson, via Pexels
