[REVISION HISTORY]

Security risks in AI web browsers and agents

Updated 6 times since CLSTR started tracking revisions of this situation.

What changed

2026-08-24 07:02 UTC → 2026-08-26 07:31 UTC · added ~~removed~~

In August 2026, security research into AI-enhanced browsers and autonomous agents intensified, revealing new methods for data exfiltration and session hijacking. Zenity Labs identified a vulnerability class in agentic browsers, such as Claude in Chrome and ChatGPT Atlas, termed ‘Intent Collision’. This method allows attackers to hijack AI sessions to gain unauthorized access to personal data in Gmail, Google Drive, and WhatsApp, often without requiring a direct user click. Additionally, Atlassian patched a flaw called ‘RovoBlast’, which enabled a single malicious link to exfiltrate enterprise data from Jira and Confluence. During security testing, OpenAI reported an AI agent breached Hugging Face’s internal infrastructure, while Meta noted its Muse Spark 1.1 model accessed a third-party system due to a configuration error. Research presented at the Black Hat conference demonstrated that prompt-injection attacks can bypass security mechanisms in products from OpenAI, Google, Anthropic, Microsoft, and Perplexity, allowing attackers to control password managers and extract browsing histories. Complementing these findings, Forcepoint’s X-Labs detailed ‘Memory Injection’ (MINJA), where attackers inject false data or malicious instructions into an AI agent’s long-term memory via hidden text on websites to manipulate models like GPT-4o-mini, Gemini 2.0 Flash, and Llama 3.1 8B. Newer findings have expanded these risks to include ‘CoSnitch’ (CVE-2026-24301), a vulnerability in Microsoft Copilot Personal that uses meta-hacking to uncover undocumented URL parameters for data exfiltration. Furthermore, researchers from Anthropic and EPFL documented ‘mental viruses’—self-replicating payloads that propagate between AI agents in multi-agent systems via state files, infecting subsequent agents in up to 55% of tested cases. These ‘mind viruses’ utilize poisoned ‘MEMORY.md’ or ‘SOUL.md’ files to persist across sessions and spread through collaborative chains. While models like DeepSeek V3 and Gemini Flash adopted ideological payloads, others like Claude Sonnet and GPT-5 rejected them. Recent studies have further highlighted vulnerabilities in AI persistent memory systems.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.