Research explained
Brave’s screenshot tests show prompt injection can arrive as pixels
Research on AI browsers explored nearly invisible image instructions alongside conventional page-based attacks.
What happened
Brave’s follow-up research on agentic browsers examined instructions embedded in screenshots and other page content. The researchers described tests involving Comet and additional browser assistants, with disclosures coordinated with the vendors.
The important boundary is not simply text versus images. Content being interpreted for a user can still contain instructions from somebody else, and an assistant may have access to accounts or tools that the content’s author does not.
This historical research does not establish current exploitability across every browser release. Review agent permissions, isolate sensitive accounts where practical and require confirmation before an assistant sends information or changes account state.
Next step
Test visual inputs as well as page text when evaluating browser-agent security.
What remains unknown
- Open question
- The sources reviewed do not establish whether your deployment was exploited.
Source references
-
BRA