AI browsers can be tricked by hidden instructions on web pages
What happened: New “AI browsers” and assistants can do things for you: read pages, fill forms, check your email and calendar. Security researchers keep showing that they can be taken over by hidden instructions, a problem called prompt injection.
- In March 2026, Zenity Labs showed that several AI browsers, including Perplexity’s Comet, could be hijacked through a normal-looking calendar invite with hidden instructions in it. Before it was fixed, the attack could make the browser read files on the computer and send them to the attacker, and even get into a password manager. Perplexity fixed the issue in February 2026.
- In April 2026, the Cloud Security Alliance reported that this has moved from experiments to real attacks: researchers found hidden instructions on live websites trying to make AI agents send payments, delete files or steal keys. It cited Google’s finding that pages carrying such instructions rose by about 32% between November 2025 and February 2026.
OpenAI has said prompt injection in AI browsers is “unlikely to ever” be fully solved, though the risk can be reduced.
Why it matters for you: An AI agent reads everything on a page, including text you can’t see. If it has access to your email, bank or passwords, a malicious page can try to give it orders.
What to do:
- Don’t give an AI agent access to your bank, UPI, password manager or work email unless you really need to.
- Use agents for reading and drafting, and approve every action that sends, pays, deletes or shares.
- Log out of sensitive accounts in the browser where the agent runs, or use a separate browser profile.
- Keep AI browsers and extensions updated: fixes come often.
Learn more in our guide: When a message gives your AI secret orders.