COMMENTARY: AI-powered browsers like Copilot, Gemini, and the OpenAI Atlas browser have reshaped how we interact with the web — moving from manual clicks to smart task delegation.These intelligent agents can read, understand, and respond to web content. They can quickly perform tasks such as filling out forms, uploading files, calling APIs, and retrieving data, frequently engaging with sensitive systems in the process.[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]While AI’s autonomy boosts productivity, it also increases the places and ways data and credentials can be exposed. As AI agents blur the lines between user, application, and automation, governing this era requires identity-first controls, data-aware policies, session containment, and continuous validation rather than a return to bluntly blocking innovation.These risks show the need for modern controls that use AI, offer visibility, enforce rules, and guard against accidental data leaks. It’s especially important as new threats like “HashJack” emerge from active red-team testing and security research.“HashJack” has become an emerging research direction within Cato CTRL that looks at how AI-driven browsers and agents might unintentionally leak authentication artifacts, such as session tokens or credential hashes, during automated web interactions. The concept builds on the known pass-the-hash (PtH) attack method that have long been observed inside LAN environments.A pass-the-hash attack involves an attacker obtaining a hashed version of a user's password and using it to gain access to other systems. Rather than decrypting the password, the attacker “passes” the hash directly to initiate a new session and impersonate the user. This technique is frequently used in Windows environments, but it’s also applicable to other operating systems and authentication protocols.HashJack was inspired by pass-the-hash techniques, exploring how AI-driven browsers might get manipulated into exposing reusable authentication artifacts. Instead of reusing password hashes like traditional PtH attacks, HashJack examines how malicious instructions hidden in the “#” URL fragment could influence LLM-powered assistants to leak tokens or perform unintended actions. Since fragments are not sent to servers and often bypass inspection, they present a unique risk if AI agents interpret them blindly to be more accurate.
The hidden risks of AI browsers
AI browsers merge the capabilities of large language models (LLMs) with full web interactivity, dissolving the traditional network and endpoint boundaries. As organizations start to use these tools, recent analysis shows several new threat patterns. These patterns require careful attention and updated governance, including:- Prompt injection and data exfiltration: Malicious web content or cleverly crafted prompts can trick agents into revealing sensitive information or performing unauthorized tasks.
- Autonomous actions in real time: AI agents can carry out complex workflows almost instantly. This speeds up the chance for errors or harmful redirects.
- Exposure to malicious destinations: Automated browsing makes it easier for online threats to slip through, leaving systems more exposed to phishing scams, malware-laden sites, and untrusted domains that can infiltrate endpoints or steal sensitive data.
- Human-in-the-loop gaps: Users might unknowingly share passwords, personal details, or other sensitive information when they enter prompts. They may not realize how that information could be reused or exposed downstream.
