The Hidden Dangers of Browsing AI Agents
Date: 2025-05
Affected: Browser-Use, OpenAI Operator, Anthropic Computer-Use
Attack vector: prompt-injection
Category: research
Severity: High

Practical study of indirect prompt injection, domain validation bypass, and credential exfiltration against browsing AI agents like Browser-Use and Operator, with end-to-end PoCs.


Mitigations:

Architectural layers (MAESTRO):