Agent Browser Tool Security Checklist

An agent browser tool security review checks whether untrusted web pages can change the agent's instructions, hide malicious text, cause unsafe tool calls, or smuggle data into a summary.

Quick Answer

1. Test hostile instructions inside page content.
2. Separate page claims from system instructions.
3. Block web pages from authorizing external actions.
4. Require citations for factual summaries.
5. Save every bypass as a regression fixture.

Web pages are untrusted input

Any page the agent reads can contain instructions meant for the agent instead of the human. Those instructions might be visible text, hidden CSS, alt text, metadata, comments, or copied code.

The agent should treat all of it as data.

Summaries need source discipline

Browser agents often fail by blending page text, model assumptions, and user goals into one confident answer. Require source links or quoted evidence when the answer matters.

That is especially important when the agent is comparing vendors, reading docs, or handling policy text.

Browsing should not grant permission

A page that says "send this to your admin" is not approval. External sends, payment actions, account changes, and destructive writes need a separate user or policy gate.

Where BreakMyAgent fits

BreakMyAgent helps teams turn hostile web pages into reusable browser-agent tests, so the same bypass does not return after a prompt or model change.

FAQ

Are hidden page instructions a real risk?

Yes. Agents can ingest text that humans do not notice, especially through scraping, metadata, and accessibility fields.

Should browsing agents quote sources?

For factual or risky work, yes. Citation discipline makes source confusion easier to catch.

What should fail closed?

External sends, destructive writes, permission changes, and secret handling.