AI Agentic Browsers and Automation Pose New Security Risks
The rapid adoption of agentic AI technologies in enterprise environments is leading to significant security incidents and operational disasters. High-profile cases, such as the accidental deletion of an entire codebase by an AI agent at Replit, highlight the risks of deploying autonomous AI systems without robust governance and oversight. Experts warn that as organizations integrate more AI agents capable of taking independent actions, the likelihood of unintended and potentially catastrophic outcomes will increase. Security professionals emphasize the need for comprehensive planning, internal governance committees, and new technical safeguards to prevent such incidents from proliferating as AI becomes more deeply embedded in business processes.
The emergence of 'agentic' AI browsers marks a fundamental shift in the threat landscape, transforming browsers from passive tools into active, autonomous agents capable of executing tasks on behalf of users. This evolution introduces new attack surfaces and challenges for security teams, as these browsers can now interact with web content, initiate transactions, and potentially make decisions without direct human oversight. Security experts urge organizations to reassess their risk models, implement stricter controls, and prepare for a future where AI-driven automation can both enhance productivity and introduce novel vulnerabilities that traditional security measures may not address.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
3 events from the most recent confirmed update back to the earliest known activity.
Rubrik warns early enterprise AI agent deployments are causing failures
By December 2025, Rubrik CPO Anneka Gupta said early enterprise deployments of agentic AI were already producing high-impact failures and argued that governance, visibility, and access controls are the main barriers to safe rollout.
Rubrik announces Agent Rewind for agent change rollback
In August 2025, Rubrik announced its Agent Rewind product, designed to inspect changes made by AI agents and roll back incorrect actions as organizations adopt agentic AI.
Replit AI coding tool deletes a company's code database
In July 2025, a Replit AI coding tool reportedly deleted a company's entire code database, cited as an example of an agentic AI system taking the shortest path to an objective with damaging consequences.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
AI agents are already causing disasters - and this hidden threat could derail your safe rollout
zdnet.com
Open sourceWebinar: The "Agentic" Trojan Horse: Why the New AI Browsers War is a Nightmare for Security Teams
thehackernews.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Enterprise Security Risks of AI-Enabled Web Browsers
Gartner has issued a warning to businesses about the adoption of AI-powered or agentic web browsers, citing significant cybersecurity risks associated with these emerging technologies. These browsers, developed by both major vendors and new entrants such as OpenAI and Perplexity, offer advanced automation, content summarization, and workflow management features. However, Gartner's advisory urges CISOs to block all AI browsers for the foreseeable future, emphasizing that the convenience and efficiency gains do not outweigh the current security concerns, which include potential data leakage, unauthorized access, and the immaturity of security controls in these products. Industry experts echo the need for caution, highlighting that while AI browsers can streamline research and personalization, they also introduce new attack surfaces and risks related to credential theft, session hijacking, and exposure of sensitive information. The rapid integration of AI into browsers has outpaced the development of robust governance, observability, and lifecycle management practices, making it critical for organizations to prioritize security and oversight before deploying these tools in business environments.
Jun 29, 2026
AI Agents and Agentic Browsers Introduce New Enterprise Security Risks
Commentary and research coverage warned that **AI agents**—including “agentic browsers” that act on a user’s behalf—are creating new enterprise attack surfaces faster than governance and detection are maturing. SC Media argued organizations should not wait for NIST guidance to treat AI agents as a security priority, citing a lack of visibility into what agents can access and do (tools, data, actions, and auditability) and emphasizing that agents can cause harm through authorized-but-dangerous actions even without traditional “compromise.” Dark Reading, citing **Trail of Bits** research, described how agentic browsers can undermine decades of browser security hardening by treating the agent as a trusted proxy that can traverse tabs and local resources, weakening isolation assumptions that underpin controls like the **same-origin policy**. Trail of Bits’ findings highlighted practical abuse paths where attackers can manipulate an agent’s context (for example via **reflected XSS**) and then induce **data exfiltration** by persuading the agent to send local or cross-tab information to attacker-controlled infrastructure—classes of attacks that modern browsers have made significantly harder for direct user sessions. Other items in the set were general risk-management or unrelated vulnerability/news pieces (e.g., Oracle patch volume, GitLab 2FA bypass, cloud demo misconfigurations, and enterprise browser selection guidance) and did not materially add to the specific story about agentic/AI-agent security regression and emerging exploitation techniques.
Jun 29, 2026
Security Risk Management for Agentic AI in Browsers and Applications
Security teams are increasingly treating **agentic AI**—systems that can interpret untrusted content and take actions—as a new class of enterprise risk that breaks assumptions in traditional security and threat modeling. As AI moves into user-facing workflows, especially where models can reason over web content and instructions, untrusted inputs can influence behavior in ways that resemble *inferred intent* rather than explicit user actions, expanding the attack surface beyond conventional boundaries designed for deterministic software. Socradar highlighted that **AI-based browsers** vary materially in risk: “assistant” modes (e.g., summarization on request) can often be governed with existing controls, while **agentic browsers** that autonomously navigate and act within a user session introduce risks that classic browser security models were not designed to contain—particularly when page text/metadata becomes model input. Microsoft emphasized that **threat modeling for AI applications** must adapt because generative/agentic systems are probabilistic, have uneven performance across languages and contexts, and treat conversation/instructions as part of a single input stream; this requires planning for rare but high-impact failure modes and adversarial manipulation rather than relying on predictable code paths and stable input/output behavior.
Jun 29, 2026