2025‑12‑08 — Consulting giant Gartner issued a strong, explicit recommendation to enterprise security leaders: fully ban “AI browsers” that embed generative agents or automated actions for the foreseeable future.
The report notes that such browsers can act on behalf of users to “click, fill forms, download files, run scripts and interact with third‑party services” on web pages. That means an attacker or a malicious model could automate complex browser operations at scale via conversational instructions, potentially bypassing traditional human‑centric security controls.
Gartner’s analysis highlights two key risks. The first is the “lazy user” risk: employees may delegate mandatory compliance or security training and sensitive tasks to agents, leaving organisations unable to prove human involvement or that authentication processes were properly executed. The second is the amplified attacker capability: automated agents can be used for targeted phishing, credential harvesting, session hijacking and even expand social‑engineering into multi‑step automated attack chains.
The report gives examples showing that an AI browser’s automated actions can seamlessly perform steps including downloading attachments, triggering backend API calls and modifying web forms; without proper isolation and data loss prevention (DLP) controls, these actions could expose corporate assets, sensitive text or credentials to external models or third‑party services. Gartner stresses that generative models do not always correctly identify sensitive data or respect confidentiality boundaries, and hallucinations or erroneous actions can be amplified into real‑world risks in automated scenarios.
At the same time, analysts, in a companion commentary titled "Analysts worry lazy users could have agents complete mandatory infosec training, and attackers could do far nastier things," note that attackers could not only have agents perform legitimate tasks but could induce agents to execute malicious steps that are “more covert and faster than a human,” such as chained privilege escalation, automatically moving sensitive data across multiple sites, or persistent password‑retry attacks.
Gartner therefore recommends a conservative approach: treat browsers and extensions with generative‑agent capabilities as high‑risk assets and prohibit or strictly isolate their operation on enterprise networks and endpoints. Organisations should prioritise vetted, controlled environments (such as isolated virtual machines or hardened browser instances), strengthen DLP policies, block unauthorized external model calls, and enforce stricter multi‑factor and least‑privilege controls for authentication and session management.
The report also urges security teams to watch supply‑chain risks: if agents rely on third‑party models or plugins, attackers could inject dangerous functionality into automation flows via model poisoning, malicious extensions or server‑side backdoors, expanding the attack surface without user awareness.
The recommendation is intended to give enterprises a long‑term defensive posture — not to entrust key business processes to agents that can act autonomously on the web until the technology matures. Gartner’s stance directly challenges the “give productivity to AI” trend, arguing that until verifiable execution evidence and robust isolation measures are in place, allowing such technologies to operate freely in enterprise environments is too costly.
For teams that wish to trial these features, the report advises conducting evaluations in tightly controlled sandbox environments, clearly defining the data scope agents may access, the trustworthiness of audit logs, and rapid kill‑switch mechanisms for anomalies or misuse.
For both security leaders and product teams, Gartner’s message is unambiguous: in its 2025‑12‑08 position, AI browsers are not merely productivity tools but a class of technology that must be managed as a potential attack surface.