The short version
- An AI browser reads web pages for you and can act on them: click, type, send. Anything it reads can carry instructions aimed at the AI, not at you.
- OpenAI's own position is that this attack, called prompt injection, "is unlikely to ever be fully 'solved'".
- The danger is the access. An assistant that is logged in to your mailbox and your banking can be turned against you by a single web page.
- Use AI browsers for public research. Keep agent mode away from company email, finance and client data until your policy says otherwise.
What is an AI browser?
An AI browser is a web browser with a built-in assistant that can read the page you are on and carry out tasks for you. Typical tasks are comparing products, filling in forms and replying to email. ChatGPT Atlas from OpenAI and Comet from Perplexity were built this way from the start, and Microsoft Edge and Google Chrome have added Copilot and Gemini features that do similar work.
The appeal is obvious. You stop copying text between tabs and start asking for outcomes: "find the three cheapest flights and put them in a table", "summarise this 40-page tender". The step that matters for security is the one from reading to doing. An assistant that only answers is a chatbot. An assistant that clicks, types and sends on your behalf is an agent, and an agent has your access.
What is prompt injection?
Prompt injection is an attack in which text hidden in a web page, document or email is read by an AI assistant as an instruction to follow and not as content to summarise. The attacker never touches your computer. They only need the assistant to read something they wrote.
It works because a language model receives everything as one stream of words. Your request and the page's contents arrive together, and the model has no dependable way to tell which words came from you. George Chalhoub of UCL's Interaction Centre put it this way to Fortune: prompt injection "collapses the boundary between the data and the instructions". The hidden text can be white on white, tucked into an HTML comment, or simply posted as a comment on a forum.
Has a prompt injection attack actually worked?
Yes. In August 2025 the browser maker Brave published a working demonstration against Perplexity's Comet browser, and the whole attack began with a user clicking "Summarise this page". The steps are worth reading slowly, because nothing in them looks like hacking.
- The user opens a Reddit post. One comment contains instructions hidden behind a spoiler tag.
- The user asks the browser's assistant to summarise the page.
- The assistant reads the hidden comment and follows it. It opens the user's Perplexity account page and reads their email address.
- The assistant starts a login on a lookalike address, which sends a one-time password to the user's inbox.
- The assistant opens Gmail, where the user is already signed in, and reads the one-time password.
- The assistant posts the email address and the password as a reply to the Reddit comment, where the attacker collects them.
Brave reports that this ran without any further input from the user. Perplexity issued fixes, and Brave noted when it published that this kind of attack had still not been fully mitigated.
Can prompt injection be fixed?
Not completely, according to the companies building these products. OpenAI wrote in December 2025 that "prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully 'solved'", and said that agent mode in ChatGPT Atlas "expands the security threat surface", as Fortune reported.
That is an honest statement, and it is the right way to think about the risk. Vendors are reducing it: OpenAI trains an automated attacker to find weaknesses before criminals do, and offers a logged-out mode and a watch mode that asks you to confirm sensitive actions. Brave's recommendations to the industry are similar: treat page content as untrusted, check the assistant's planned actions against what the user asked for, require confirmation for anything sensitive, and keep agent browsing separate from everyday browsing. None of that removes the problem. It turns a certain failure into an occasional one, which is exactly how the industry treats phishing.
What is the real risk for a South African business?
The real risk is an AI agent acting with a staff member's full access inside systems that hold personal and financial information, with nobody having decided that it should. In KnowBe4 research reported by Business Report in July 2026, 38% of South African cybersecurity leaders said autonomous AI agents were already performing tasks independently in their organisations, and 64% of organisations said AI was being used without proper governance or approval.
Put those two numbers next to the Comet demonstration. An agent that can read a mailbox can read client details, ID numbers and bank confirmations. If a web page tricks it into sending any of that out, the business has had a security compromise under POPIA, and the duty to notify the Information Regulator applies whether a person or a piece of software made the mistake.
Which tasks are safe to give an AI browser?
Public research is safe to hand over, anything behind a company login needs a decision, and money and admin consoles are off limits. The table sets out a sensible place to draw the line today.
| Task | Risk | Rule |
|---|---|---|
| Summarising public articles, comparing products, general research | Low | Fine. Use it signed out of work accounts, or in a separate browser profile |
| Filling in web forms with public business details | Medium | Allowed, with a person reviewing the form before it is submitted |
| Reading and replying to company email, managing calendars | High | Not in an AI browser's agent mode. Use the assistant inside Microsoft 365 or Google Workspace, where your admin controls apply |
| Online banking, payroll, supplier and SARS portals | Not acceptable | Never. A person does these, with two-person approval on payments |
| Admin consoles for Microsoft 365, Google Workspace, firewalls or backups | Not acceptable | Never. Admin accounts are used in a clean browser with no assistant installed |
What should an AI policy say about AI browsers and agents?
An AI policy should name which tools are approved, what they may connect to and which actions always need a person. Six rules cover most of it.
- Approved tools only. List the AI browsers and extensions staff may install on work devices. Everything else is blocked by device management, not by trust.
- Separate profiles. Agent features run in a browser profile that is not signed in to company email, files or finance systems.
- Confirm before acting. Any setting that makes the assistant ask before it sends, buys, deletes or submits stays switched on.
- Specific instructions. Staff give the assistant a narrow task, not "do whatever is needed". OpenAI gives its own users the same advice.
- No secrets in reach. Password managers stay locked while an agent is working, and admin accounts are never used in a browser that has an assistant.
- Report the odd moment. If an assistant does something nobody asked for, staff stop and report it, the same way they would report a suspicious email.
These rules sit alongside the ones for chat assistants in Using AI Without Leaking Business Data, and the tool choices in AI Tools for South African SMEs.
How does AMEA help businesses use AI agents safely?
AMEA Technologies rolls out AI tools with governance in place from the first day: a readiness assessment, an acceptable AI use policy that staff can follow, secure deployment with data controls, and training. The AI adoption service covers the rollout, and IT policy and documentation covers the written rules.
What are the sources for this article?
- Brave, 20 August 2025: the Comet demonstration, disclosure timeline and recommended defences.
- Fortune, 23 December 2025: OpenAI's statement on prompt injection and ChatGPT Atlas.
- Business Report, July 2026: KnowBe4 research on AI agents and governance in South African organisations.