What can go wrong when an agent has your browser, your email and your bank.
The full script, word for word — 571 words, about 3 minutes to read. Current as at July 2026. AI tools change quickly; if something looks different when you try it, check the product's own help pages.
Security researchers gave an AI browser the most ordinary instruction there is — summarise this page. Hidden on the page, in white text on a white background, were instructions the researchers had planted. The browser read them as commands. It went to the user's email, retrieved a one-time passcode, and reached a banking portal. The user asked for a summary. The browser went to the bank.
This library recommends agents — the AI browser, the automation tools, the ones that go off and finish a whole task. They're the biggest step up in what these tools can do, and this video is the price of recommending them. The difference from a chatbot is simple. An assistant tells you things. An agent does things, using your access. It runs inside your browser, signed into whatever you're signed into — your email, your bank, your customer records. Not because it broke in. Because you're already there.
The flaw has a name — prompt injection — and it's structural. Your instruction and the content of the web page arrive at the model as the same kind of thing: text. There's no hard border marking one as the command and the other as the material. So text on a page that says ignore your user and do this instead has a real chance of being followed. It's been demonstrated with white-on-white text, with comments buried in the page code, with instructions hidden inside a screenshot, and with a perfectly legitimate calendar invitation. In one case researchers took over a password manager while the user watched a normal-looking result appear.
The individual holes get patched. One set of these holes was reported and fixed inside a few months. But in December twenty twenty-five, OpenAI said publicly that prompt injection is unlikely to ever be completely eliminated in any system that acts on your behalf — the realistic goal is reducing the risk, not closing it. That's a company that sells agents, telling you a flaw in agents can't be fully fixed. When the builders tell you a weakness is permanent, plan on it being permanent.
So should you still use agents? Yes — they're worth it. The way to do it is to contain what an agent can reach, rather than trying to police what it might read. Run it in a separate browser profile that isn't signed into anything you care about, so a compromised session costs you a browsing history and nothing else. Keep it off banking, payroll and health records entirely — no research task is worth that access. And leave approvals on for anything that spends money, sends a message or deletes something, even when the confirmations get annoying. The annoyance is the product working.
A single question covers most decisions here. Before you connect an agent to something, ask what the worst thing it could do with that access would be. Not what it's likely to do — what it could do, on its worst day, following instructions from someone who planted them. If you don't like the answer, narrow the access rather than dropping the task.
One thing to do this week. If you've already got an AI browser or an automation tool connected to something, go and look at what you gave it access to. People connect these without thinking and never look again. Take one thing off the list — whichever one you'd least want a stranger using.