01 / Overview
Why AI Agents Introduce New Risk
An AI agent is software that autonomously performs actions on behalf of a user — sending emails, browsing the web, filling forms, executing code, managing files. Because agents act with legitimate user-level permissions, the blast radius of a compromised agent is significantly larger than that of conventional malware.
Browser-based AI agents are particularly exposed: they can search, click, type, and submit forms across any website the user is already logged into. This capability, designed for convenience, is also a direct path to unauthorized access to financial and payment services.
Attacking an AI agent may require no special technical capability. The agent already runs in the user's authenticated environment, and browser-stored credentials may be readable at user-level access. This is what makes the risk structurally different — and underappreciated.
02 / Attack Chain
How Financial Loss Can Occur
The threat is not a single exploit but a chain of steps that, when combined, can result in unauthorized transfers or payments. The following represents a realistic attack path via a browser-operating AI agent.
This chain does not require privilege escalation. As long as the AI agent operates under the user's own account, the path to browser-stored credentials is already open. No kernel exploits. No admin rights. Just user-level access.
What Is Prompt Injection?
Prompt injection embeds hidden instructions for the AI inside web pages, documents, or other content the agent processes. When the agent reads such content — for example, to summarize a webpage — it may interpret the hidden instructions as legitimate commands and execute them without the user's awareness.
Why Browser-Stored Credentials Are the Weak Link
Most browsers store passwords and session tokens locally, accessible at user-level. When an AI agent runs in the same user session, it may inherit that access. Unlike traditional phishing — which requires the user to be deceived directly — this path bypasses the human entirely once the agent is misdirected. This is the distinctive danger of agentic AI.
03 / Key Insight
What Is Not Yet Widely Understood
Security discourse around AI agents tends to focus on prompt injection and data exfiltration. The following dimensions receive less attention — and represent underappreciated risks.
| Dimension | Common Assumption | Reality | Severity |
|---|---|---|---|
| Privilege escalation requirement | Attacks require elevated privileges | User-level access is often sufficient | High |
| Browser credential exposure | AI cannot access saved passwords | May be accessible depending on environment | High |
| User permission behavior | Users grant permissions carefully | Convenience pressure leads to over-permissioning | Medium–High |
| Attack automation | Attacks require human operation | AI execution changes speed and scale | Medium–High |
| Effectiveness of 2FA | Two-factor authentication is sufficient | Can be bypassed under certain conditions | Medium |
Granting an AI agent broad access means entrusting it with your authenticated environment. The question is not only "what can this agent do for me?" but "what could this agent do to me if misdirected?" That reframing is the foundation of sound agentic AI security.
04 / Defense
Breaking the Chain: Four Defensive Layers
The attack chain can be interrupted at any stage. Defense-in-depth — addressing multiple layers simultaneously — is the most resilient approach, since no single control is reliable on its own.
Input Validation & Control
- Validate external content before passing it to the agent
- Restrict agent actions to an explicit allowlist
- Monitor agent behavior logs in real time
- Flag and quarantine suspicious content automatically
Credential Hygiene
- Avoid storing passwords in the browser at all
- Run the agent in an isolated, dedicated browser profile
- Never use production accounts for agent operations
- Audit and restrict access to the credential store at OS level
Access Control
- Block agent access to financial and payment sites entirely
- Restrict automated interaction with sensitive web services
- Separate personal finance and work AI environments
- Detect anomalous navigation patterns by the agent
Transfer & Payment Controls
- Require out-of-band re-authentication (SMS / phone) for transfers
- Auto-halt on changes to payee or amount
- Impose a cooldown period on irreversible operations
- Never allow AI to complete a payment without human confirmation
The right posture is not "this cannot happen" but "assume it can happen, and limit the damage." Irreversible operations — wire transfers, payments, account changes — must never be completable by an AI agent alone.
05 / User Guidance
What to Check Before Using an AI Agent
Technical defenses are the responsibility of system administrators and developers. But end users also have a meaningful role. The following guidance applies to anyone who uses or is considering using an AI agent.
What Permissions Are Safe to Grant — and What Are Not
| Permission Type | Recommendation | Rationale |
|---|---|---|
| Read-only access (specific folder) | Acceptable | Scope is limited; impact is contained |
| Web search / information retrieval | Acceptable | Low risk; be aware of prompt injection in results |
| Live browser profile access | Use with caution | Exposes saved passwords and active sessions |
| Email / calendar send permissions | Limit scope | Risk of accidental send or information leakage |
| Financial / payment service access | Avoid | Direct path to unauthorized transfers |
| File write / delete permissions | Limit scope | Explicitly constrain target directories |
Personal Checklist
- Is the AI agent running in a dedicated, isolated browser profile?
- Have you avoided saving financial service passwords in the browser?
- Do you review the permissions granted to the agent periodically?
- Can you inspect a log of what the agent has done?
- Does every payment or transfer require your explicit final approval?
- Are you tracking updates and vulnerability disclosures for your agent?
06 / About
Purpose and Background
This site is an awareness resource designed to make AI agent security risks understandable to both technical and non-technical audiences.
The risks documented here are not entirely novel — they draw on known attack categories including prompt injection, phishing, session hijacking, and credential theft. What is new is the combination: an automated agent operating with user-level permissions, able to traverse authenticated services at machine speed, guided by misdirected instructions.
In particular, the observation that privilege escalation is not required for browser credential access — that user-level permissions may be sufficient — has not yet achieved broad recognition. This site places that point at its center.
Nothing on this site is intended to facilitate or encourage attacks. All content is published for the purposes of defense, risk assessment, and user education. Information reflects the state of knowledge at time of writing and may require updating as the technology evolves.
Maintained by Taiji Yamada
/ Part-time Lecturer, Tokyo University of Science
Related: AI Usage Tips
|
日本語版