Agentic LLM Browsers Expose New Attack Surface for Prompt Injection and Data Theft

Varonis Threat Labs reports that agentic LLM browsers (examples: Comet, OpenAI/Atlas, Microsoft Edge Copilot, Brave Leo) expose privileged communication channels between AI backends and browser internals, enabling exploits—via indirect prompt injection and XSS on trusted origins—that can command extensions with debugger-level permissions to read local files, exfiltrate data, and perform actions using user credentials. The research demonstrates concrete abused tools (e.g., GetContent, Edge.Context.GetDocumentBody), confirms real-world proof-of-concept impact and a patched prompt-injection case, and recommends least-privilege extension policies, monitoring for anomalous browser-driven file reads/outbound connections, and timely browser updates.