AI Browsers Need a New Security Model

The web browser has spent decades doing a fairly simple job. It displays websites, stores sessions and passwords, downloads files and lets people move between online services. AI is beginning to change that role.

A browser equipped with an AI agent can read pages, compare information, fill in forms, work across several tabs and interact with services where the user is already logged in. Give it enough access and it can move from researching a hotel to booking it, from reading an invoice to entering its details into accounting software, or from reviewing an email to updating a customer record.

That capability makes browser-based AI unusually useful. It also creates a security problem that conventional browser permissions were never designed to solve.

Traditional software security largely asks what an application may access. Agentic security must also ask what the software may decide to do with that access.

The Browser Suddenly Has Authority

Most people already give their browser access to an extraordinary amount of private information. Email accounts, cloud storage, company dashboards, payment services, social networks and password managers often sit behind active browser sessions.

Until recently, the browser itself rarely decided what to do inside them. The person clicked the button.

An AI agent changes that relationship because it can interpret an instruction and translate it into a sequence of actions. A request such as “find the invoices from last month and organise them” can involve searching email, opening attachments, downloading files, reading financial information and placing documents into another application.

Each individual action may look ordinary. The security question emerges from the combination.

An employee could reasonably have access to email and a finance platform while still being prohibited from transferring certain information between them. A browser agent may technically possess access to both systems, so companies need controls that understand the difference between permission to view information and permission to act on it.

That distinction will shape the next stage of enterprise AI deployment.

Prompt Injection Becomes More Dangerous When AI Can Act

Large language models can be manipulated by instructions embedded in material they read. Security researchers call one form of this problem prompt injection.

With a conventional chatbot, a malicious instruction hidden on a webpage may distort an answer. The result can be annoying, misleading or unsafe, depending on the situation.

A browser agent creates a larger attack surface because the model may also possess tools.

Imagine asking an agent to research suppliers. One supplier website contains hidden text designed to influence AI systems. The instruction tells the agent to ignore its previous task, retrieve information from another open tab and submit it through a form.

A properly secured agent should reject the instruction. Companies cannot build their security model around that assumption alone.

Software developers have spent decades separating data from executable instructions for good reason. AI agents partially blur that boundary because they interpret natural language from several sources at once: the user, websites, documents, application interfaces and previous interactions.

The browser therefore needs to treat external content as untrusted input even when the language model finds that content persuasive.

Permissions Need To Become More Specific

Current software permissions tend to operate at application level. A user grants access to a camera, microphone, location or folder. Enterprise administrators can also restrict websites, extensions and authentication behaviour.

Agentic browsing requires a more detailed model.

A company might allow an AI agent to read information from its CRM while preventing it from deleting records. It might permit an agent to prepare an email while requiring human approval before sending it. Finance teams could allow invoice extraction while blocking payments. Procurement systems could permit product searches without authorising orders.

These distinctions turn “AI access” into several separate permissions.

Read: the agent may inspect information.

Write: the agent may create or modify information.

Communicate: the agent may send messages or submit forms.

Transact: the agent may make purchases, payments or contractual commitments.

Delete: the agent may remove information or records.

Authenticate: the agent may use credentials or access another service on the user’s behalf.

Companies will probably need combinations of these permissions rather than a single switch marked AI enabled.

The most sensitive actions can then trigger an approval step. A human sees what the agent intends to do, which account it plans to use and what information will leave the system before authorising the action.

Good security design makes those interruptions selective. Requiring approval after every click would remove much of the efficiency that makes agentic browsing attractive. Allowing every action automatically would give probabilistic software an uncomfortable amount of authority.

Identity Creates Another Complication

Browser agents also raise a surprisingly basic question: who performed the action?

When an employee manually updates a customer record, the audit trail can attribute the change to that employee. When an AI agent acts through the employee’s authenticated session, the system may still record the employee as the actor even though software selected and executed the action.

That becomes difficult when teams investigate an error.

Enterprise systems will need to distinguish between actions performed directly by a person and actions delegated to an agent. Logs should record the initiating user, the AI system, the instruction it received, the tools it accessed and the action it completed.

Without that information, companies can discover that they have automated work faster than they have automated accountability.

The same principle applies to shared agents. A company may eventually operate agents that serve a department rather than an individual employee. Those systems will require their own identities, permissions and audit records in much the same way that service accounts already do.

AI Browsers Will Force Companies To Classify Actions

The easiest way to adopt browser AI is to focus on the model: how accurate it is, how fast it works and whether employees enjoy using it.

Security teams need to examine the actions instead.

Reading a public webpage carries little organisational risk. Reading an internal contract carries more. Editing a customer record adds another level of exposure. Sending information outside the company or committing money introduces a different category altogether.

Companies can classify those actions before choosing how much autonomy to allow.

Low-risk work can run automatically. Moderate-risk actions can require stronger logging or restricted destinations. High-risk actions can require explicit human approval or remain unavailable to the agent.

This approach also helps companies avoid a common problem with new technology: imposing such broad restrictions that employees simply work around them.

An AI browser that cannot access anything useful will not become safer. Employees may instead copy confidential information into less controlled tools. Granular permissions allow security teams to protect sensitive actions while leaving ordinary productivity features available.

The Browser Could Become One of AI’s Most Useful Interfaces

AI companies have spent years trying to create assistants that sit beside existing software. Browser agents offer another route because much of modern work already happens inside the browser.

They do not need every company to replace its CRM, accounting system, travel platform or project software. The agent can work across the interfaces employees already use.

That makes the browser an unusually powerful place for AI. It also places the agent close to credentials, company information and systems capable of producing real-world consequences.

The successful AI browser will therefore need more than strong reasoning. It will need precise permissions, visible approvals, reliable audit trails and clear boundaries between information the agent can read and actions it can perform.

The browser spent its first decades helping people navigate the web.

Its next job may be helping software navigate the web for us. Security architecture will determine how much freedom we are prepared to give it.