Agent browser security: 2025 year-end review

Wiz Research published its 2025 year-end review, summarizing multiple prompt injection and data exfiltration studies that surfaced in agent browsers over the year, and compiling vendors' security configurations. The review listed attacks including Johann Rehberger's zero-interaction exfiltration, Guardio Labs testing Perplexity Comet with fake stores and phishing links, Brave's disclosure of indirect prompt injection in Comet, and disclosures by Tenable, LayerX, Cato Networks, and Google researchers targeting products such as Comet, Atlas, and Operator, involving URL parameter hijacking, long-term memory poisoning, and task injection. On the defense side, vendors shifted from asking before actions to multi-layer architectures, with human-in-the-loop becoming a common guardrail; differences lay in reinforcement learning, architectural isolation, and secondary LLM review. The article offered three recommendations: isolate context, retain human confirmation, and limit agents to handling only low-risk tasks.