Research demo
Agentic browsers break the same-origin policy: cross-origin data theft demonstrated on ChatGPT Atlas
AIR-2026-0144 AIR record · 2026-06-uw-agentic-browsers-same-origin
From the supporting source
the same-origin policy is reduced to the strength of an agent's defenses against prompt injections in multiple agentic browsers todayagent-security.cs.washington.edu
The record
Disclosed
2026-06-30
Vendor
OpenAI; Google; Anthropic; Perplexity; Brave; Microsoft; Mozilla
Product
ChatGPT Atlas (Agent Mode); Chrome with Gemini; Claude for Chrome; Perplexity Comet; Brave Leo AI; Microsoft Edge with Copilot; Firefox AI Mode
Risk domain
Privacy › Data exfiltration channels
Also touches
Sensitive data exposure, Confused deputy
System type
Generative model
Who acted
Agent acted — the agentic browsers read cross-origin content and exfiltrated it
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection web content
Impact type
Data exfiltration, Privacy violation, Security boundary violation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI02 – Tool Misuse and Exploitation
- MITRE ATLAS
- AML.T0024 – Exfiltration via AI Inference API
- NIST AI RMF
- MAP 4.2
- EU AI Act
- Article 10
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- A. Data & Privacy
- Scope
- tool misuse
- Mitigation
- Monitor network traffic for anomalous patterns; Restrict egress destinations.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
seven agentic browsers tested; four permitted same-origin-policy bypass
Capability abused
Defense & remediation
Recorded defense
browser same-origin policy plus each agent's injection defenses
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
varied; several vendors declined or did not reply
Taxonomy & references
Curator notes
Franziska Roesner and David Kohlbrenner, UW Security and Privacy Research Lab; project page last updated 15 Apr 2026, UW News release 30 Jun 2026. End-to-end 'successful cross-origin data theft attack' was executed against ChatGPT Atlas in Agent Mode; conditions for similar attacks were found in Chrome with Gemini, Claude for Chrome and Perplexity Comet. Disclosed to all vendors with 60+ days notice: Brave, Google and Microsoft acknowledged; OpenAI and Firefox declined; Anthropic had not replied at publication. NOT the same work as arXiv 2606.14027 'Same-Origin Policy for Agentic Browsers' (Wang, Chen, Li, Song, Gong) - see quarantine.
Supporting sources
Cite as
Enkrypt AI. "Agentic browsers break the same-origin policy: cross-origin data theft demonstrated on ChatGPT Atlas". AIR, AIR-2026-0144. https://agentincident.vercel.app/i/AIR-2026-0144/ (accessed 2026-10-19).