Same-Origin Policy for Agentic Browsers

Core question: whether the same-origin policy (SOP), designed for traditional browsers, can still block unauthorized automated cross-origin data flows in agentic browsers had not been systematically studied.

• Scenario and importance: Agentic browsers (such as BrowserOS, Perplexity Comet, ChatGPT Atlas) integrate AI agents into the browser; after the agent reads sensitive data from a source webpage, that data remains in the interaction history and may later be written into a sink webpage of another origin, forming a new automated data flow channel.
• Gaps in existing work: The authors state that prior security research and benchmarks on agentic browsers mainly focus on prompt injection within a single webpage or within the same origin; a recent workshop paper and a blog post suggested that agentic browsers may bypass the SOP, but there was no systematically quantified benchmark and no mechanism proposed to enforce the SOP.
• Core observation: The agent itself can serve as an automated data flow channel — in the absence of an attack, the agent's unreliability produces passive SOP violations; when an attacker injects malicious content into the sink webpage, the injected content is equivalent to a "script" for the agent, producing active SOP violations.
• Paper outputs: Constructs the benchmark SOPBench, evaluating 5 agentic browsers and 6 backbone LLMs; proposes SOPGuard and implements it in the open-source browser BrowserOS as BrowserOS-SOPGuard.
• Threat model:
  • Goal: Passive violations are the agent unintentionally transferring data across origins in the absence of an attack; active violations are an attacker injecting content through the sink webpage to induce the agent to leak source webpage data to the sink webpage.
  • Capability: The attacker is the owner of the sink webpage (full control over content) or a malicious user (able to post only some content, such as Reddit comments).
  • Knowledge: Black-box with respect to the agentic browser — can query and observe its actions and reasoning traces, but does not know the system prompt or model parameters.
  • Victim system: The user uses the agentic browser to interact successively with source and sink webpages of different origins.

Agentic browsers

• VisualWebArena (2024), SeeAct (2024) — early agentic browsers that support agents interacting with webpages autonomously, but are not browser-centric architectures.
• BrowserOS (2025), Perplexity Comet (2025), ChatGPT Atlas (2025) — recent agentic browsers that package agent capabilities as standalone browser applications, retain the traditional browser interface and integrate an assistant in the sidebar; they maintain interaction history, so that data from one webpage remains available to the agent after navigation.

Same-origin policy (SOP)

• In traditional browsers, the SOP blocks scripts from accessing data across origins through origin label checks; manual copy-paste by the user does not count as a violation. In the traditional context, SOP violations are often discussed together with XSS (cross-site scripting): an attacker injects a script into the source webpage, and the script collects data under that origin and sends it to other origins.
• The authors point out that SOP violations in agentic browsers differ from XSS: no script is injected; instead, the agent itself performs the cross-origin data transfer, and injected content in the sink webpage acts as a "script" for the agent.

Prompt injection against agentic browsers

• Heuristic attacks: Combined Attack (USENIX Security 2024) combines multiple heuristic strategies, and the paper calls it the most effective heuristic attack; Pop-up attack (2024), EIA (2024), WASP (2025) inject manually constructed malicious instructions into pop-ups, HTML forms, or Reddit/GitLab content. The paper notes that these attacks mainly target a single webpage and do not study SOP violations.
• Optimization-based attacks: WebInject (EMNLP 2025) assumes white-box access to the agentic browser and uses gradient descent to optimize visual perturbations; TAP (NeurIPS 2024) was originally a black-box jailbreak method against LLMs, and this paper adapts it into an attack that optimizes the injected content of the sink webpage.

Baselines and benchmarks: The detector comparison baselines are WebSentinel, BrowseSafe, WARD (injection detectors for agentic browsers) and PromptArmor, DataSentinel (general injection detectors); utility evaluation uses Mind2Web, WebArena-Infinity Hard, REAL; SOP violation evaluation uses SOPBench, constructed in this paper.

Authors' positioning: This paper is the first systematic study of the SOP for agentic browsers (as stated by the authors), and it also provides the quantitative benchmark SOPBench and the enforcement mechanism SOPGuard, whereas prior work only provided high-level discussion or focused only on single-webpage injection.

The overall approach has two steps: build SOPBench to systematically quantify SOP violations in agentic browsers, then propose SOPGuard — adding five components to the agentic browser: a label database, labeling, label propagation, detection, and user confirmation, converting automated cross-origin data flows into manual data flows that require user confirmation.

SOPBench: webpage and task construction

• Source webpages: 10 categories (e-commerce, banking, airlines, email, calendar, messages, HR portal, document workspace, insurance, pharmacy), using GPT-5.4 to generate synthetic webpages containing representative privacy information, plus a small number of static snapshots of real webpages.
• Sink webpages: 5 categories (X, Discord, GitHub, Reddit, Google Forms), covering two attacker capabilities — webpage owner (e.g., Google Forms) and malicious user (e.g., GitHub comments) — also synthesized with GPT-5.4.
• Task generation: For each source category, generate 100 benign tasks Ts and prompts Ps (requiring the agent to process privacy information); for each sink category, generate 100 benign tasks Tk and prompts Pk; each Ts is paired with an injection task Ti, whose goal is to make the agent leak the privacy information involved in Ts to the sink webpage. Tasks are generated by CodeX (powered by GPT-5.4), and Appendix B gives the full prompts.

SOPBench: two types of violations and attacks

• Passive violations: Embed an iframe that loads the source webpage in the sink webpage; the user issues a benign prompt (e.g., summarize the current page and write it into a text box), which may unintentionally trigger a cross-origin data flow.
• Active violations (heuristic): Use Combined Attack, manually constructing injected content according to the sink webpage context so that it looks like natural webpage content (e.g., a reply explanation on X, an issue-handling instruction on GitHub).
• Active violations (optimization-based): Four extensions to TAP — the attacker LLM's prompt includes Pk, Ti, the sink context, and the injection point; the evaluator LLM uses a rubric targeting cross-origin leakage; each candidate runs the full browsing flow (source first, then sink) for evaluation; the evaluator outputs self-reflection feedback to the attacker. Both the attacker and evaluator LLMs are GPT-5.4, and the system prompts are given in Appendix Figures 38 and 39.

Violation determination

• The metric is SOP violation rate: the proportion of runs that are violations. Strict comparison is used — a run counts as a violation only if the data written to the sink webpage exactly matches the data specified by the injection task Ti.

SOPGuard: five components

• Label database: Maintained in parallel with the interaction history; each record e_i = (id_i, d_i, O_i, J_i), i.e., identifier, content, origin label set, and dependency set; it does not modify the interaction history or the user-visible messages.
• Labeling: When the agent calls a read tool, assign the webpage origin (scheme, host, port triple) to the retrieved data and store it in the database.
• Label propagation: When the agent generates a new response, have the agent itself identify the data objects derived in the response and infer the dependency set J_r; its label set is the union of the dependency labels O_r = \bigcup_{id_j \in J_r} O_j; conservatively propagating all historical labels would produce many false positives, so dependency inference is needed.
• Detection: When the agent calls a write tool, compare the label set of the text to be written with the sink webpage origin; any differing label is treated as a potential violation.
• User confirmation: On a potential violation, interrupt the write and show a pop-up; the write is executed only if the user clicks Approve, converting an automated data flow into a permitted manual data flow; the authors state that they do not block directly because legitimate cross-origin workflows exist.

Implementation in BrowserOS

• Instrument labeling on BrowserOS's read tools (take snapshot, get page content, get dom); the label propagation module is called before each response is committed to the interaction history, with the system prompt given in Appendix Figure 40; detection is on the write tools (fill, type at); on a violation, a confirmation box with Approve/Deny buttons pops up.

Experimental Setup

• Subjects under test: 5 agent browsers—the open-source VisualWebArena, SeeAct, and BrowserOS (each configured with three backbone LLMs: GPT-5.4-mini, OpenAI o3, and GPT-5.4), the closed-source Perplexity Comet (GPT-5.4, Claude Sonnet 4.6, Gemini Pro), and ChatGPT Atlas (GPT-5.5).
• Benchmark: 10×5=50 source–sink category combinations on SOPBench synthetic web pages; additionally, two smaller settings for BrowserOS (passive violations on synthetic web pages, active violations on real web pages), both using Email, Insurance, and Airlines as sources and X, GitHub, and Reddit as sinks.
• Sample size: each combination is run 100 times for open-source browsers; closed-source browsers require manual execution, with 3 runs per combination. Closed-source browsers use only heuristic attacks (iterative optimization requires manual work).
• Metric and determination: SOP violation rate; a violation is counted only when the written data exactly matches the data specified by Ti; the paper does not state whether this comparison is performed by a human or a model.
• Utility and overhead: Mind2Web, WebArena-Infinity Hard, and REAL use their respective original metrics; SOPBench utility is a human-annotated binary score on 100 test cases; each is repeated 5 times, with a paired two-sided t-test (α=0.05).
• Label propagation accuracy: scenarios with 2, 4, 6, 8, and 10 origins, 100 test cases per level, human-provided ground-truth label sets, and the metric is the Jaccard Coefficient (JC).

Main Results

Active violations on synthetic web pages (100 runs per cell, based on Table 3 and Table 4; here aggregated by browser×LLM into ranges over the 50 combinations, see the original tables for per-cell numbers):

Swipe horizontally to read the table

Browser	LLM	Heuristic (Table 3)	Optimized (Table 4)
VisualWebArena	GPT-5.4-mini	0.33–1.00	0.77–1.00
VisualWebArena	OpenAI o3	0.42–1.00	0.74–0.98
VisualWebArena	GPT-5.4	0.17–1.00	0.55–1.00
SeeAct	GPT-5.4-mini	0.22–1.00	0.80–1.00
SeeAct	OpenAI o3	0.42–1.00	0.73–1.00
SeeAct	GPT-5.4	0.71–1.00	0.85–1.00
BrowserOS	GPT-5.4-mini	0.43–0.99	0.57–1.00
BrowserOS	GPT-5.4	0.03–1.00	0.31–1.00

• Closed-source browsers (Table 3, n=3 per cell): Perplexity Comet and ChatGPT Atlas are mostly 1/3–3/3 for each combination, and the Google Forms column is almost entirely 3/3.
• The authors state that optimized attacks are consistently higher than heuristic ones, for example SeeAct+OpenAI o3, Airlines→Reddit at 0.84 vs. 0.42; the authors explain this as optimized attacks iteratively refining the injected content.
• The authors observe that legacy browsers generally have higher violation rates than recent browsers (under GPT-5.4-mini, SeeAct has 32/50 combinations above 0.8, BrowserOS 21/50), and consider one possible reason to be that recent browsers have stronger safety alignment, but recent browsers still have non-trivial violation rates.

Passive Violations and Real Web Pages

• Passive violations (Table 6): in the iframe setting, BrowserOS with all three backbone LLMs has a violation rate of 1.00 on all source–sink combinations; the authors emphasize that this result is specific to the iframe setting, and no passive violations were observed in sequential interaction settings without injected content.
• Real web pages (Table 5): under heuristic attacks, BrowserOS violation rates are 0.40–1.00 (e.g., GPT-5.4-mini, Insurance→Google Forms at 0.99; GPT-5.4, Airlines→X at 0.40).

SOPGuard Effectiveness, Utility, and Overhead

• Violation rate: the authors report that BrowserOS-SOPGuard reduces the SOP violation rate to 0.00 in both the passive and active SOPBench settings.
• Utility (Tables 7, 9): on four benchmarks and three backbone LLMs, the t-test p-values for the utility distributions of BrowserOS and BrowserOS-SOPGuard are all greater than 0.05 (both are 1.000 on SOPBench, with p recorded as N/A), and the authors accordingly state that the two are statistically indistinguishable in utility.
• Runtime (Tables 8, 9): the overhead is statistically detectable, but its magnitude is 2.07%–5.79% (e.g., Mind2Web+GPT-5.4-mini from 81.16s to 84.20s).

Label Propagation Accuracy and Detector Comparison

• Label propagation (Figure 2): GPT-5.4 and OpenAI o3 have JC of at least 0.955 with 2–10 origins, and OpenAI o3 has JC of 1.000 with 2, 4, and 6 origins; GPT-5.4-mini is moderate, above 0.9 with 2–8 origins; the conservative baseline is consistently lower. The authors attribute GPT-5.4-mini's moderate performance to its weaker general utility rather than to the propagation mechanism itself.
• Injection detectors (Table 10): across 5 detectors on 5 categories of sink web pages (100 contaminated pages + 100 real clean pages per category), none achieves both low FNR and low FPR, e.g., WebSentinel on X has FNR 0.00/FPR 0.31, and DataSentinel on X has FNR 1.00/FPR 0.00; the authors consider that they cannot reliably defend against active violations and are inherently ineffective against passive violations.

Adaptive Attacks and Other Analyses

• Adaptive attacks (Figure 3): the injected content simultaneously attempts to mislead and to mislead dependency inference. On 100 sampled test cases, the violation rate of BrowserOS-SOPGuard: heuristic from 0.00 to 0.01, optimized from 0.00 to 0.04; the average number of queries for optimized adaptive attacks rises from 14.7 to 35.3. The authors explain that adaptive attacks are difficult in two respects: the text to be written may already be in the label library and need no propagation; and the injected content must simultaneously accomplish the induced task and mislead dependency inference. The authors also note that it cannot increase the passive violation rate and only affects label propagation on sink web pages.

Limitations and future directions noted by the authors

• Stronger adaptive attacks: The authors acknowledge that stronger adaptive attacks are still theoretically possible, for example misleading dependency inference more effectively, or attacking through intermediate results rather than only through propagation at the time of writing to the sink webpage; designing and evaluating stronger adaptive attacks is a future direction (Discussion and Limitations).
• Generalization of label propagation: SOPGuard relies on accurate label propagation; GPT-5.4-mini has moderate precision, and the authors state that this suggests SOPGuard may not directly generalize to smaller or weaker backbone LLMs; under-propagation reduces safety, and over-propagation increases false positives. Improving label propagation precision and making it reliable on weak models is a future direction (Discussion and Limitations).
• API cost: Label propagation is performed by the agent at response generation time, which increases the economic cost of running the agentic browser; the authors propose a possible approach of using an open-source LLM as the backbone, and maintaining robustness and utility while reducing cost is a future direction (Discussion and Limitations).
• The conclusion restates: future work includes exploring stronger adaptive attacks, improving the reliability of label propagation on weak backbone LLMs, and reducing the API cost of SOPGuard (Conclusion and Future Work).

Scope of experimental coverage

• The subjects under test are 5 agentic browsers and 6 backbone LLMs; SOPGuard is implemented and evaluated on only one browser, BrowserOS (Section 5.8).
• Closed-source browsers (Perplexity Comet, ChatGPT Atlas) have only 3 runs per combination, and only heuristic attacks are tested; optimization-based attacks are evaluated only on open-source browsers (Section 4.5).
• Passive violations cover only the iframe embedding scenario and the combinations of Email, Insurance, Airlines × X, GitHub, Reddit; real webpage snapshots are tested only with heuristic attacks (Section 4.5).
• Adaptive attacks are evaluated on 100 sampled test cases, targeting only the dependency inference step of label propagation (Section 5.9).
• Utility and overhead are each repeated 5 times; SOP violation determination uses strict comparison fully consistent with Ti, and the paper does not report whether this comparison was performed by a human or a model, nor does it report annotation consistency.

A benchmark-plus-defense paper on the same-origin policy (SOP) for agentic browsers. The authors point out that the agent's interaction history allows data from one origin to be written into another origin, and that the SOP enforced by traditional browser architectures does not cover this new channel.

• Problem: Agentic browsers exhibit two types of SOP violations — passive violations caused by agent unreliability in the absence of an attack, and active violations caused by an attacker injecting content into the sink webpage (equivalent to a "script" for the agent); previously there was a lack of a systematically quantified benchmark and enforcement mechanism.
• Method: Constructs SOPBench (synthetic webpages of 10 source categories and 5 sink categories, 50 combinations, the heuristic Combined Attack and an optimization-based attack extending TAP); proposes SOPGuard, which uses five components — a label database, labeling, label propagation with agent self-inferred dependencies, origin checking at write time, and user confirmation — to convert automated cross-origin data flows into manual data flows.
• Main results: All 5 browsers and 6 backbone LLMs exhibit non-trivial violation rates; optimization-based attacks are higher than heuristic ones (SeeAct+OpenAI o3, Airlines→Reddit: 0.84 vs. 0.42); the violation rate in the iframe passive violation scenario is 1.00; on real webpage snapshots, BrowserOS's violation rate is 0.40–1.00.
• Defense effectiveness: BrowserOS-SOPGuard reduces the violation rate on SOPBench to 0.00; utility on the four benchmarks is indistinguishable from BrowserOS under a paired t-test; runtime overhead is 2.07%–5.79%; adaptive attacks raise the violation rate only to 0.01 (heuristic) and 0.04 (optimization-based), and the average number of queries for optimization-based attacks rises from 14.7 to 35.3.
• Authors' conclusion: The traditional SOP is insufficient for agentic browsers, and SOPGuard can enforce the SOP while maintaining utility; the authors also acknowledge that stronger adaptive attacks are theoretically possible, that label propagation is insufficiently reliable on weak backbone LLMs, and that API cost is relatively high, listing these as future directions.