The browser agent met the hostile webpage
Prompt injection stopped being an exotic prompt trick when browser agents could navigate to pages, fill forms, click controls and download files. The webpage itself became part of the agent’s instruction environment—and therefore part of the attack surface.
Prompt injection stopped being an exotic prompt trick when browser agents could navigate to pages, fill forms, click controls and download files. The webpage itself became part of the agent’s instruction environment—and therefore part of the attack surface.
Anthropic’s November 2025 account of browser-use defenses describes the practical problem. An attacker does not need to control the model directly if a page can influence what the agent sees and what it believes it must do to complete the user’s task.
The right defense is layered. Models need training and classifiers, but deployments also need narrow credentials, content isolation, confirmation for consequential actions and durable logs. A browser agent should treat every page as potentially untrusted input. The web is not a neutral workspace; it is an ecosystem of instructions written by strangers.
