Every AI browser tested at Black Hat fell to prompt injection, and Brave's researcher says there's no clean fix.

In "Attacking and Defending AI Browsers," Brave security engineer Artem Chaikin said every browser he analyzed proved vulnerable to indirect prompt injection, demonstrating live against Opera's AI browser, Perplexity Comet, and ChatGPT Atlas (Dark Reading). The root cause is structural: agents can't distinguish page content from hidden instructions in an email, shared doc, calendar invite, or webpage. Result is data exfiltration and account takeover. Chaikin's conclusion is that guardrails are improving but the threat class isn't going away. Treat agentic browsing as an untrusted-input problem, not a model-alignment one. Which makes Argos, launched on Product Hunt this week as an AI that operates in your own logged-in browser session, an interesting thing to ship the same week. It inherits every authenticated cookie you hold.