Same-Origin Policy for Agentic Browsers

A new study finds that agentic browsers — web browsers controlled by autonomous AI agents — routinely violate the same-origin policy, a bedrock web security rule, and proposes a dedicated enforcement mechanism called SOPGuard to close the gap [1][2]. The same-origin policy (SOP) prevents scripts from one website from accessing data on another, a safeguard that underpins modern browser security [6][7]. Researchers from the paper “Same-Origin Policy for Agentic Browsers” argue that the rise of agentic browsers, which let users issue natural-language commands to complete web tasks, has created an unexamined threat: the AI agent itself can become an automated channel for cross-origin data flows [1][2]. To measure the problem, the team built SOPBench, a benchmark for evaluating SOP violations in agentic browsers, and found that existing systems frequently breach the policy in both benign scenarios and under active attack [1][2]. A separate study accepted at ICLR 2026 corroborates these findings. Franziska Roesner and David Kohlbrenner examined seven agentic browsers, including ChatGPT Atlas and Chrome with Gemini, and documented a wide range of design choices governing how embedded agents interact with web content [3][4]. In the least restrictive implementations, a malicious website that successfully injects a prompt can leverage the browser agent to steal cross-origin content or forge user actions on other sites [3][4]. The authors demonstrated a full proof-of-concept attack on ChatGPT Atlas and noted that several other browsers met the preconditions for cross-origin attacks [3][4]. A third research effort, detailed in a separate arXiv preprint, catalogued attacks that revive ten heavily mitigated web threats that modern browser architectures were designed to close [5]. The authors distilled the failures into five broad modes: agents bridging cross-site data, agents bridging same-site data, agents hallucinating URLs, websites attacking the large language model directly, and agents misusing integrated tools [5]. The paper concludes that meaningful protection of confidentiality and integrity will likely require rearchitecting agentic browsers around a security model aligned with a formal threat model, rather than retrofitting safety atop existing designs [5]. To address the enforcement gap, the SOPGuard proposal introduces a mechanism tailored specifically for agentic browsers [1][2]. The researchers implemented SOPGuard in BrowserOS, an open-source agentic browser, and report that it enforces the same-origin policy while preserving utility and adding only a small runtime overhead [1][2]. The code and data have been released publicly [1][2].