On October 25, 2025, TechCrunch published an article detailing how AI browser agents (AI agents), with their ability to "browse and perform tasks on behalf of users," amplify traditional browsers' security blind spots. Unlike human‑driven browsing, these agents can automatically click links, fill forms, upload/download files, invoke APIs and save page content. The article lists multiple easily exploitable details.
First, agents typically need access to the page DOM, read responses and manipulate forms when performing tasks. This creates a risk of "credential and session data leakage": if an agent by default carries existing cookies or session tokens, it may expose sensitive cookies, OAuth redirect tokens or CSRF tokens to third‑party domains or embedded resources without per‑action user confirmation. TechCrunch notes that automated scripts rely far less on same‑origin policy and fine‑grained permissions than human operators; if a script follows a malicious page's "navigate anywhere" prompt, the consequences can be severe.
Second, pages can use "prompt injection" to trick agents into performing unauthorized actions. The article describes attackers disguising誘導ive instructions as page content or hiding them in HTML comments, image alt text or iframes to alter an agent's decision logic. For models that rely on textual prompts to determine next steps, mixed visual‑and‑text covert instructions are especially hard to detect.
Third, file upload and download capabilities open channels for data exfiltration. TechCrunch points out that an agent completing tasks may automatically grab local files or send collected data to external services; in enterprise environments, sensitive documents, API keys or internal links could be transmitted to attacker‑controlled endpoints without human verification.
The article also emphasizes the chain risks introduced by plugins and third‑party integrations. Companies such as Perplexity and OpenAI integrate external tools or APIs to extend capabilities, but if those third‑party services are compromised or poorly designed, they become weak links in the agent ecosystem. TechCrunch cites security researchers saying many current implementations rely on a "trust stack" and lack end‑to‑end permission minimization and auditable behavior.
To address these issues, TechCrunch lists several mitigations: enforce stepwise authorization and operation confirmation so each sensitive action requires explicit consent; apply origin constraints and request signing to ensure actions can only be triggered by specific domains or constrained contexts; run agents in stricter sandbox environments that limit network access and filesystem permissions; and record auditable logs and request provenance to support post‑incident analysis and accountability.
The article closes with a reminder that although AI browser agents can greatly improve individual productivity—making tasks like summarizing content, conducting procurement searches or organizing materials more convenient—as of October 25, 2025 organizations and individuals should prioritize security. Rapidly rolling out new features must be accompanied by stricter default permissions, visualized decision paths and more robust anomaly detection; otherwise the convenience of automation could quickly be abused for large‑scale theft and tampering.