# Researchers Demonstrate New Prompt-Injection Technique Against AI Browser Agents

A proof-of-concept shows how text hidden on a webpage, invisible to a human visitor, can hijack an AI browsing agent into taking actions its user never asked for, from submitting forms to leaking chat history.

A team of independent security researchers has published a working demonstration of a familiar problem in a newly dangerous setting: hiding instructions in a webpage where a human visitor would never notice them, but an AI browsing agent reads and follows them as if they came from its own user.

## The mechanics
The trick isn't novel in itself, prompt injection[↗](/prompt-injection) has been documented against chatbots for as long as chatbots have been able to browse or call external tools. What's new is where the researchers placed it: white-on-white text, an HTML comment, or an off-screen element on an otherwise ordinary page. Most AI agents have no reliable way to distinguish "instructions from my actual user" from "text that merely appeared somewhere I was reading," and if that hidden text reads like a command, several tested agents simply obeyed it.

## Why the stakes are higher for agents than chatbots
A chatbot that gets tricked produces an odd reply. An agent that gets tricked can click buttons, fill in forms, and manage a shopping cart, the blast radius of a successful injection now extends to real-world actions, not just text on a screen.

## What's changing in response
Several agent developers have acknowledged the report. Mitigations already in progress include:

- Stricter separation between instructions the user typed directly and content read from a page the agent is merely browsing.
- Mandatory explicit confirmation before an agent takes any action with a real consequence, a payment, a message sent, an account change.
- Content-provenance checks that flag pages with suspicious hidden text before an agent is allowed to act on anything it finds there.
Until those land broadly, the practical advice is simple: don't point an AI browsing agent at an unfamiliar site for anything sensitive, and actually read the confirmation prompts it shows you instead of clicking through them.

Source: [Brave Research: Agentic Browser Security](https://brave.com/blog/comet-prompt-injection/)