Prompt Injection and AI Agents - Why Browser-Based Agents Have a Bigger Attack Surface
Prompt Injection and AI Agents
There is a fundamental security difference between AI agents that run inside the browser and those that interact with it from the outside.
Browser-based agents operate within the page context. They read the DOM, execute JavaScript, and process page content as part of their input. This means any malicious content on the page - hidden text, invisible divs, manipulated API responses - goes directly into the agent's context window.
This is not a theoretical risk. Prompt injection payloads embedded in web pages have been demonstrated repeatedly. A weather API response, a forum post, even an email body can contain instructions that override the agent's original task.
The Native Agent Difference
A native desktop agent that uses accessibility APIs interacts with the browser from the outside. It sees the browser as a window with UI elements - buttons, text fields, links - not as raw HTML or JavaScript.
This does not make native agents immune to prompt injection. If the agent reads text on screen that contains malicious instructions, it could still be influenced. But the attack surface is significantly smaller because:
- No JavaScript execution. The agent never runs code from the page.
- No DOM parsing. Hidden elements, invisible text, and CSS tricks do not exist in the accessibility tree.
- Structured interaction. The agent interacts with labeled UI elements, not raw content streams.
Defense in Depth
The right approach is layered:
- Reduce the attack surface by operating outside the browser context where possible
- Use bounded tools so the agent cannot take arbitrary actions even if injected
- Require approval for sensitive actions like sending messages or modifying files
- Validate outputs before executing actions that affect the real world
No single defense is sufficient. But starting with a smaller attack surface makes every other layer more effective.
Fazm runs natively on macOS and interacts with browsers through accessibility APIs, not page injection. Open source on GitHub. Discussed in r/ClaudeAI.