The Web's Attack Surface Just Switched Sides

David Martin Riveros · August 13, 2026 · 4 min read

On August 4 a federal appeals court ruled that an AI shopping agent is, legally, its user. I wrote about that decision last week. The same week, at the Black Hat security conference in Las Vegas, a Brave engineer named Artem Chaikin presented a year of research on AI browsers. Every one he analyzed could be steered by instructions hidden in a web page. Data theft and account takeover, from the act of reading. Put the two events together and the story of the month inverts. For twenty years, the web's bot problem ran in one direction: sites defending themselves against automated visitors. The agent era reverses the arrow. The bot now carries your login, your inbox and your saved card, and the page it visits is the attacker.

One comment, one click, one stolen account

The attack class is called indirect prompt injection: instructions planted in content an agent reads, which the model cannot reliably tell apart from its owner's orders. The canonical demonstration is a year old. In August 2025, Brave's researchers hid instructions behind a spoiler tag in a Reddit comment and asked Perplexity's Comet browser to summarize the page. The agent read the comment and followed it. It opened the victim's account page and read their email address. It triggered a one-time login code. It opened the victim's logged-in Gmail, read the code, and posted both into the Reddit thread for the attacker to collect. One click on "summarize", one hijacked account.

Everything since has been variations on the ink. Faint light-blue text on a yellow background, invisible to the person but recovered by the browser's own screenshot OCR, which is text recognition run on the image. White text on a white background driving Gmail exfiltration in OpenAI's Atlas during its first week. Hidden HTML in Opera Neon. One browser, Fellou, could be injected by the act of visiting a page.

Defense in depth, bypassed anyway

The Black Hat session matters because it graded the fixes, not the launches. A year of disclosures bought real defensive work. Atlas carries the most visible stack: system-level prompting, tags marking content trusted or untrusted, a second model scanning for attacks, approval prompts before sensitive actions. Chaikin got through anyway, per Dark Reading's account of the talk. Attackers could mimic the trusted-content tags in their own page, so the poison arrived pre-labeled as safe. Data smuggled out through URL fragments was not scanned at all.

The detail I keep thinking about is quieter. Free-tier users who hit their usage cap were downgraded to a cheaper model, and the cheaper model was easier to inject. Nobody designed that. It is what happens when a security boundary lives inside a model whose strength varies with the customer's plan. Readers of this site's passports essay will recognize the shape: on the agentic web, even your attack surface has a pricing tier.

The researchers closest to this bug class do not describe it as a patch backlog. Johann Rehberger, who found several of the Atlas attacks: "Prompt injection cannot be 'fixed.' As soon as a system reads untrusted data and includes it in an LLM query, the untrusted data influences output." OpenAI's own security chief calls it a frontier, unsolved problem. Every fix so far filters the ink. The next disclosure finds new ink.

The old war, with the sides swapped

I have spent years on the other side of this arrow. In web data collection, the page defends and the visitor's software adapts, and an entire bot-management industry sells that defense. Every move in the new fight is a twenty-year-old move with the sign flipped. Hidden text was cloaking, a trick sites used to show crawlers different content than humans. Now it steers the crawler's descendants. The wall used to face outward. The valuable software is now on the visitor's side of it, so the wall has to turn around.

The court ruling is what makes this load-bearing. Authorization now flows from the user through the agent, which means the agent legally holds the richest thing on the web: a logged-in session with money and mail behind it. I am not outside this blast radius. This essay was researched by an agent reading web pages unattended on my server, the same fleet of scheduled jobs I inventoried in the Claude 5 migration essay, and that machine has my email tooling wired into the agent runtime. Untrusted pages plus reachable credentials in one context is exactly the combination every disclosure above exploits. The only honest defense I know is structural: the research agent works in a repository, and nothing it publishes skips a human gate.

If the model cannot be trusted to ignore the ink, the session has to be too poor to rob. Brave's stated architecture points there: agent profiles logged out by default, a floor under model strength, checks that the agent's actions still match the user's ask. So does the containment turn in the ruling's wake. My falsifiable read: by the end of 2027, no major AI browser still runs its agent inside the user's full logged-in profile by default. Sessions become scoped, granted per task, and revoked after. If Comet, Atlas and their successors still default to the open session eighteen months from now, this essay aged badly, and somebody's incident report will explain why. The courts spent this summer deciding the bot is the user. The engineering lesson of the same week is that the bot is also the victim, and the web it browses was never friendly territory.