Unseeable Prompt Injections in Agentic Browsers (Perplexity ...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://brave.com/blog/unseeable-prompt-injections/
• Blog Title: Unseeable Prompt Injections in Agentic Browsers (Perplexity Comet and Fellou)
• Suggested Section: Phishing Methodology > Ai Agent Mode Phishing Abusing Hosted Agent Browsers (add a subsection: "Agentic Browsers Prompt Injections: OCR-based and Navigation-based")

🎯 Content Summary

What the post shows: Brave’s security team demonstrates two indirect prompt-injection vectors in agentic AI browsers that can operate “with your credentials” via tool use (navigate, click, fill forms, etc.). No CVEs are assigned. Severity is high because injected natural-language instructions from untrusted web content can drive cross-origin actions despite the Web’s same-origin policy.

Threat model and root cause: Agentic browsers compose LLM prom...

🔧 Technical Details

OCR-based prompt injection via screenshots: Hide agent instructions in images (near-invisible but machine-readable). When an agentic browser screenshots a page and extracts text (e.g., via OCR), that text is fused into the LLM prompt without proper provenance, allowing the hidden instructions to direct tool use (navigation, form fill, data exfiltration) under the user’s session.

Navigation-triggered prompt injection from visible content: If an agent sends page content to the LLM upon mere navigation, attacker-controlled visible text can override the user’s request and steer the agent’s tools. This converts ordinary webpage text into cross-origin actions with the victim’s cookies/tokens.

🤖 Agent Actions

I analyzed the Brave blog and the existing HackTricks content related to phishing and AI prompt injection. The agentic browser prompt injection vectors (OCR-based via screenshots and navigation-triggered via visible page content) were not covered in the “AI Agent Mode Phishing: Abusing Hosted Agent Browsers (AI‑in‑the‑Middle)” page.

What I updated:

• Added a new subsection “Agentic Browsers Prompt Injections: OCR‑based and Navigation‑based” to:
  • Describe the threat model where agentic browsers fuse user intent with untrusted page-derived content (including OCR text).
  • Detail Attack 1 (Perplexity Comet OCR-based injection via screenshot) with a minimal hidden-text HTML overlay example suitable for OCR capture.
  • Detail Attack 2 (Fellou navigation-triggered injection from visible content) with a concrete visible payload example.
  • Explain why these bypass typical defenses and the SOP.
  • Provide concise operator notes and actionable mitigations adapted from the blog.
  • Cross-reference the general prompt injection page for background.
• Updated the References section to include the Brave blog link.

Changed file:

• src/generic-methodologies-and-resources/phishing-methodology/ai-agent-mode-phishing-abusing-hosted-agent-browsers.md

Internal references:

• Added a “See also” link to the AI prompt injection page using the internal ref macro to: ../../AI/AI-Prompts.md

References added:

• Unseeable Prompt Injections in Agentic Browsers (Brave): https://brave.com/blog/unseeable-prompt-injections/

No new files were created; existing structure and style were preserved. The update keeps content concise, technical, and directly actionable for red-teamers and defenders.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://brave.com/blog/unseeable-prompt-injections/

Content Categories: Based on the analysis, this content was categorized under "Phishing Methodology > Ai Agent Mode Phishing Abusing Hosted Agent Browsers (add a subsection: "Agentic Browsers Prompt Injections: OCR-based and Navigation-based")".

Repository Maintenance:

• MD Files Formatting: 901 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0

[carlospolop]

merge