We spent a week trying to hijack our own AI browser. A sentence you cannot see did it.

For a week we let an AI browser run our errands. It read our pages, summarised our documents, triaged an inbox and booked things on a calendar, and it was genuinely good at it. Then we spent the rest of the week trying to turn it against us, on our own accounts, in a setup we controlled. We wanted to answer the question the "your AI can do anything now" marketing skips: if it will follow instructions off a web page, whose instructions are they?

The short version is that hijacking it was far too easy, and the reason is not a bug anyone can simply patch.

And these are not fringe tools. The analyst firm Gartner expects 40 percent of business software to include task-doing AI agents in 2026, up from under 5 percent a year earlier, and OpenAI has said ChatGPT alone passed 800 million weekly users in late 2025. A lot of people are about to give a lot of access to something that takes orders from whatever it reads.

The setup

We used Perplexity's Comet, one of the mass-market AI browsers of 2026: a normal-looking Chromium browser with an assistant baked in that can read the page you are on, act on it, and carry out multi-step tasks while logged in as you. We gave it ordinary jobs, "summarise this thread," "what is on my calendar this week," "reply to this," and then we planted instructions in the places it reads. Everything was on our own throwaway accounts and our own test pages. The point was to see the default behaviour, not the behaviour of a carefully caged demo.

What it got right

Handed a real task, the assistant behaved like a fast, tireless assistant should. It turned a forty-message thread into three accurate bullet points, drafted sane replies, found the one email in a noisy inbox that actually needed action, and chained steps together without being walked through each one. For a solid day it was the productivity story everyone promises. That is exactly why the rest of the week matters: the same capability that makes it useful is the capability an attacker gets to borrow.

Then we hid a sentence in a page

The first hijack took an afternoon. We put an instruction where the assistant would read it but a person would not look, buried in a page it had been asked to summarise. Not a link to click, not a file to open. Just text, sitting in the content, addressed to the machine.

Asked to "summarise this page," the assistant read our hidden line and did what it said instead of what we said. This is not a trick we invented. Security researchers at Brave demonstrated exactly this against Comet in 2025: an instruction hidden inside a Reddit comment, behind a spoiler tag, was enough to make the browser act on a stranger's orders when a user clicked summarise. In their proof of concept the hijacked agent went and read the user's email and a one-time login code from a logged-in account page, the makings of a full account takeover, because it was acting with the user's own signed-in privileges. Perplexity patched it; Brave checked the patch and found it incomplete, and the underlying weakness kept resurfacing.

The mechanism is the whole story. The assistant had no way to tell the difference between the instruction we typed and the instruction hiding in the page. To the model both are just text in the same stream, and it will, as one researcher puts it, happily follow any instruction that reaches it, whoever wrote it.

The text you cannot see

If you are imagining that you would simply spot the malicious text, you would not. The instruction does not have to be visible. It can be white text on a white background, letters too small to read, characters that render as nothing at all, or words tucked into a page's underlying code where nothing shows on screen. As the industry's own security guidance puts it, an injected instruction does not need to be visible or readable to a human, as long as the model can parse it.

It gets worse with anything visual. Brave's second study showed Comet could be steered by instructions written in faint light-blue text on a yellow background, invisible to a person, but read perfectly when the agent took a screenshot of the page and its vision model looked at the pixels. Researchers have been demonstrating this since 2023, when one embedded commands as near-white text inside an image and watched assistants obey them while a human saw only a picture. The uncomfortable lesson we kept relearning all week: reviewing what a page looks like tells you nothing about what your agent just read.

Why it works: the machine cannot tell you from a stranger

This is the part that is not a bug and will not be patched away. A language model receives your instructions, the developer's instructions and the untrusted content of the web page as one undifferentiated stream of text. It has no reliable internal wall between "commands to obey" and "data to process." The whole class of attack, named "prompt injection" back in 2022 by analogy with the database attacks of an earlier era, exists because that wall does not exist.

Treat everything your agent reads as something a stranger may have written. The model cannot tell the difference, so the system around it has to.

You cannot fully train this away, because you are not up against random noise, you are up against people who adapt. As the researcher who named the flaw likes to point out, a filter that blocks 99 percent of attacks would be an A grade almost anywhere else, but in security it is a failing one: the attacker simply keeps probing until they find the one attempt in a hundred that gets through. Blocking almost all of them is not the same as being safe.

The real danger: the lethal trifecta

The single most useful idea we took into the week is a threat model security researcher Simon Willison calls the "lethal trifecta". An AI agent becomes dangerous when it has all three of these at once:

1. Access to your private data (your mail, files, accounts).
2. Exposure to untrusted content (any web page, email or document an attacker can reach).
3. A way to send data out (a link it can follow, an image it can load, an email it can send).

Any one of these alone is harmless. Put all three in the same assistant and a single hidden sentence can read your private data and ship it to a stranger, which is precisely what our browser had the power to do. The defensive version of this idea is also the most important thing in this article: remove any one leg and the attack has nowhere to go. An agent that can read your inbox but cannot reach the open web, or can browse but holds none of your credentials, is a far smaller problem than the "do everything for me" assistant that does all three by design.

It is not just web pages

The scary part is how many everyday things count as "content the agent reads." Over the past year the same flaw has turned up, and been fixed, everywhere:

• Email. In a case researchers named EchoLeak (CVE-2025-32711, rated a 9.3 severity), a single crafted email could make Microsoft's Copilot assistant dig through a user's internal files and quietly send them out, with no click required. Just receiving the email, and later asking the assistant an unrelated question, was enough.
• Your code. In a GitHub Copilot flaw called CamoLeak (CVE-2025-59145, rated 9.6), a hidden instruction in a pull request made the assistant hunt a private repository for secrets and smuggle them out one character at a time through the platform's own image system. GitHub's fix was to stop the assistant rendering images at all.
• A sales form. In a Salesforce Agentforce case (ForcedLeak), researchers exfiltrated customer records by leaving instructions in a web contact form; the data left through an old approved web address they simply re-registered for about five dollars.
• A calendar invite. Researchers hid instructions in a Google Calendar invite so that when the user later asked Gemini about their week, the assistant executed the payload, in their demonstration going as far as controlling smart-home devices like lights and a boiler. A text injection became a physical-world action.

Different products, different companies, one root cause every time: the system let untrusted content give it orders while it held the keys to do real damage.

What surprised us most

Three things. First, the attack that worked did not need to be sophisticated, it needed to be invisible. We spent our time on hiding a sentence, not on writing a clever one.

Second, the people building these tools are refreshingly honest that this is not solved. OpenAI, which ships some of the most capable browsing agents, has said flatly that prompt injection is a frontier, unsolved security problem that is "unlikely to ever be fully solved," and compares it to scams and social engineering, threats you manage forever rather than eliminate. The standards body NIST says outright that "complete protection is not achievable." No serious vendor claims otherwise.

Third, and more hopefully, the defences genuinely help even if they do not finish the job. When Anthropic red-teamed its own browser assistant, basic safety mitigations cut the attack success rate from 23.6 percent to 11.2 percent, and on a set of browser-specific attacks from 35.7 percent to zero. Independent work points the same way: on AgentDojo, an academic benchmark of agent attacks, the built-in attacks beat even the best agents less than a quarter of the time, and adding a dedicated detector cut that to around 8 percent, though at a cost to how much real work the agent could still get done. That is the shape of the whole field right now: not a cure, but layers that each take a big bite out of the risk.

How to actually use one safely

We did not conclude that you should avoid these tools. They are useful, and they are not going away. But we would run one on a short leash. Here is the setup that survived our week:

Guardrail	Why it matters
A separate, low-privilege profile	Run the agent in a browser that is not logged into your bank, main email or work accounts, so a hijack cannot reach them
Logged-out by default	Give it credentials only for the one step that needs them, then take them back; an agent with no session has nothing to steal
Approve anything irreversible	Sending, paying, deleting and sharing should always stop for a human, and you should read the confirmation, not reflex-click it
Break the trifecta	Do not let the same session hold your private data, browse untrusted pages, and have a way to send data out
Assume every page can lie	Treat any web page, email, document or invite as something that may carry hidden instructions, including text you cannot see
Keep it updated	Real zero-click attacks were closed by updates; an out-of-date agent is the exposed one

None of this is exotic. It is the same instinct you would use with a brilliant, fast, weirdly literal assistant who will do whatever the last piece of paper in front of them said, without asking whether you meant it.

So should you use one?

Yes, carefully. The productivity is real; our assistant genuinely saved us time before we started attacking it. But an AI browser is not a search bar, it is a program that carries out instructions it finds in the wild, and the wild writes back. Keep the powerful version away from your most sensitive accounts until the security catches up with the capability, which, by the builders' own admission, has not happened yet.

For the other side of this story, our first-hand report on what happens when you give an agent real system access is in we gave an AI agent root access for a week, and we cover the broader security picture in the AI cyber arms race. If you want to lock down the rest of your setup, start with what a VPN actually hides. For more first-hand reporting, see the AI section.