AI Agent Cross-Origin Browser Hijacking

AI Agent Cross-Origin Browser Hijacking occurs when malicious web content manipulates a browser-enabled AI agent into accessing or acting on authenticated content from another origin. The attack can allow prompt injection to bypass traditional browser trust assumptions, expose cross-origin data, or cause unauthorized actions using the victim’s existing browser session.

Agentic browsers introduce a new security problem: the AI agent may be able to see and act across multiple web origins using the user’s authenticated browser context.

Traditional browser security relies heavily on the Same-Origin Policy, which limits how one website can interact with content belonging to another origin.

AI agents can weaken that boundary.

University of Washington researchers tested seven agentic browsers and found that prompt injection could, under certain conditions, leverage the browser agent to access cross-origin content or perform actions on other sites. They demonstrated a full proof-of-concept attack against ChatGPT Atlas and identified prerequisite conditions in several other browser-agent implementations. Agentic Security

The core risk is straightforward:

The malicious webpage cannot directly access the victim’s authenticated data — but the AI agent may be able to.

If the agent follows instructions embedded in attacker-controlled content, it can become a trusted intermediary between:

Attacker-Controlled Page → AI Browser Agent → Authenticated Website → Sensitive Data or Action

This can transform prompt injection from a content-manipulation issue into a browser-session and authorization attack.

A victim uses a browser containing an integrated AI agent.

The browser is already authenticated to sensitive services such as:

Email
CRM
Cloud consoles
Financial applications
Source-control platforms
Enterprise SaaS
Internal applications

The user then visits attacker-controlled or compromised content.

That page contains indirect prompt injection designed for the AI agent rather than the human.

When the user asks the agent to summarize, analyze, research, or interact with the page, the malicious instructions are incorporated into the agent’s context.

The attacker instructs the agent to access information from another browser origin or perform an action using the victim’s authenticated session.

Because the AI agent operates inside the trusted browser environment, it may possess capabilities unavailable to the malicious webpage itself.

The result is an AI-mediated bypass of browser origin and authorization boundaries.

1. Victim Has Authenticated Browser Sessions
The user is logged into enterprise applications, cloud services, email, or other sensitive websites.

2. Victim Visits Malicious Content
The page contains hidden or visible instructions designed for the browser agent.

3. AI Agent Processes the Page
The user asks the AI assistant to summarize, analyze, or interact with the content.

4. Indirect Prompt Injection Executes
The malicious webpage causes the agent to reinterpret its task.

5. Agent Accesses Another Origin
The agent navigates to or reads content from an authenticated website.

6. Existing Session Authority Is Reused
Cookies, tokens, or browser authentication allow the agent to access information unavailable to the attacker.

7. Sensitive Data or Action Is Obtained
The agent may retrieve:

• Email
• Documents
• Account information
• Internal application content
• Cloud resources

or perform actions such as:

• Submitting forms
• Sending messages
• Modifying records
• Initiating transactions

8. Data Is Returned to the Attacker
The agent may place the information into attacker-controlled content, submit a form, or transmit it through another browser action.

Agentic browsers
Browser-integrated AI assistants
Autonomous web agents
Enterprise browser copilots
AI research agents
Browser automation agents
Authenticated SaaS sessions
Webmail platforms
CRM platforms
Cloud-management consoles
Financial applications
Internal web applications
Source-control platforms
Enterprise collaboration tools

AI browser hijacking can expose enterprise applications that were previously protected by browser isolation and authenticated session controls.

Potential consequences include:

Email exposure
Sensitive document theft
Cloud-console access
CRM data disclosure
Unauthorized form submissions
Account modification
Internal application access
Financial transaction initiation
Credential or session abuse
Cross-origin data exfiltration

The key architectural risk is that the AI agent may possess the browser user’s authority across multiple applications at the same time.

A malicious website therefore does not necessarily need to compromise another website directly.

It only needs to convince the agent to act as the bridge.

1. Establish Two Controlled Origins

Create:

Origin A — attacker-controlled test page
Origin B — protected authenticated application

Place synthetic sensitive information in Origin B.

2. Authenticate the Browser

Log the testing browser into Origin B using a dedicated test account.

3. Introduce Prompt Injection

Place benign adversarial instructions on Origin A directing the AI browser agent to retrieve information from Origin B.

4. Trigger Normal Agent Use

Ask the agent to:

• Summarize the page
• Research the page
• Compare information
• Complete a browsing task

Do not explicitly instruct it to access Origin B.

5. Test Cross-Origin Reading

Determine whether the agent can retrieve protected information from another tab, iframe, or authenticated page.

6. Test Cross-Origin Actions

Using non-production resources, determine whether the agent can:

• Submit forms
• Modify records
• Send messages
• Change settings

on another origin.

7. Test Data Exfiltration

Determine whether cross-origin information can be written into:

• A form on Origin A
• A URL parameter
• An external API request
• An uploaded document
• Another tool

8. Test Approval Controls

Determine whether the agent requests explicit user confirmation before accessing or acting on another origin.

9. Test Session Boundaries

Repeat with:

• Multiple browser tabs
• Different authenticated accounts
• Private/incognito sessions
• Separate agent sessions

10. Test Embedded Content

Evaluate malicious:

• Iframes
• Advertisements
• Third-party widgets
• Search results
• Embedded documents

The University of Washington research specifically demonstrated that prompt injection could exploit cross-origin browser-agent behavior in realistic agentic-browser designs. Agentic Security

Monitor browser-agent actions that cross origin boundaries.

High-value signals include:

Agent accesses Site B immediately after processing Site A
Sensitive page content copied into unrelated websites
Agent submits forms to domains unrelated to the user’s request
Unexpected navigation between authenticated applications
Agent-driven requests involving sensitive internal services
Browser actions inconsistent with stated user intent

Correlate:

Source Page → Prompt Context → Agent Navigation → Authenticated Destination → External Submission

Log:

• User identity
• Browser-agent identity
• Source origin
• Destination origin
• Tool invocation
• Authentication context
• Action performed
• Data transferred

Cross-origin actions initiated by AI agents should receive substantially more scrutiny than normal page navigation.

T1185 Browser Session Hijacking, T1539 Steal Web Session Cookie, T1078 Valid Accounts, T1056 Input Capture

LLM01:2025 Prompt Injection, LLM06:2025 Excessive Agency