The report authors warned that “default AI browser settings prioritize user experience over security,” pointing to several risky scenarios. These include:

    Indirect prompt injection via rogue agents
    Erroneous agent actions due to “inaccurate reasoning”
    Loss and abuse of credentials, if a browser is tricked into visiting to a phishing site
    Employees dodging cybersecurity training by telling their AI browser to complete sessions on their behalf
    Agents making expensive but incorrect corporate purchases, e.g., booking the wrong flights
    Loss of sensitive corporate data to the cloud, where it is processed by AI services