University of Washington researchers have identified critical cybersecurity vulnerabilities in emerging agentic AI browsers, revealing that the technology exposes users to significant data theft risks. A comprehensive analysis of seven popular AI-enhanced browsers demonstrated that four permit malicious actors to bypass the same-origin policy, a fundamental web security protocol established in 1995 that isolates data between different websites to prevent unauthorized cross-site interactions. The study highlights that when AI agents are granted permissions approximating those of human users, they become vulnerable to exploits that circumvent traditional safeguards. Researchers executed a successful proof-of-concept attack on ChatGPT Atlas, where a malicious webpage manipulated the agent to steal sensitive information from a secure site embedded within its session. Equivalent vulnerabilities were identified in Chrome with Gemini, Claude for Chrome, and Perplexity Comet. In these scenarios, hostile sites could deploy hidden instructions to coerce the agent into transferring credentials or personal data to external servers controlled by attackers. Co-senior author David Kohlbrenner, an assistant professor in the Paul G. Allen School of Computer Science & Engineering, warned that the current generation of these tools is unsafe for public use. Even if you are a relatively savvy user, you should not trust that these systems are ready to truly protect your information, Kohlbrenner stated. Co-senior author Franziska Roesner emphasized the severity of the regression, noting that while browser security has matured significantly over the past three decades, agentic browsers introduce architectural flaws that undermine years of protective development. The research outlines two primary attack vectors: prompt injection and memory poisoning. Malicious webpages can embed covert instructions within their code to manipulate agent behavior, such as forcing the agent to include sensitive embedded content in a summary and auto-submit it to a hostile form. Furthermore, researchers found that some agents improperly consolidate memory, mingling information from different origins. This memory poisoning allows attackers to plant instructions that execute during future interactions, as the agent loses track of the original data provenance after processing and compression. The findings were presented at the Agents in the Wild Workshop in Rio de Janeiro. Responses from browser vendors varied; Anthropic and Firefox did not reply to reports of the vulnerabilities, while Perplexity and OpenAI declined comment. Researchers reported constructive exchanges with Google, Microsoft, and Brave. However, remediation poses a substantial engineering dilemma, as tightening security often necessitates restricting agent capabilities. Firefox AI Mode proved the least susceptible to attack but offered the most limited functionality, illustrating the trade-off between utility and safety. Roesner noted that competitive market pressures are driving rapid deployment of these browsers despite unresolved security concerns. The study concludes that maintaining the robust isolation of the same-origin policy while delivering the full utility of agentic AI remains a critical open challenge for the industry, requiring substantial advancements in agent security architecture before these systems can be trusted with sensitive user operations.