OpenAI and NCSC Believe Injection is Impossible to Eliminate

OpenAI does not consider command injection to be "completely solvable," and the UK's NCSC suggests that mitigation may never be total. Tests conducted in 2026 still show non-zero attack rates. In this context, the priority becomes restricting agent access and compartmentalizing their actions to limit potential damage.

Reducing the Scope: Restricted Access and Isolated Profiles

Limiting the consequences of an attack on an AI browser agent involves several recommended practices. These include restricting the connected access of agents, isolating their activity in a separate browser profile, requiring and verifying confirmation requests, and providing clear and limited instructions. It is also advised to avoid using these agents for sensitive operations such as managing emails or bank accounts. A simple configuration is to create an "Agent" profile that operates offline, without automatic approvals, so that even in the event of a compromise, the agent has very limited access.

Official Warnings: A Persistent Problem, Perhaps Endless

OpenAI believes that command injection, like scams and social engineering on the web, is unlikely to be completely resolved and anticipates that the problem will persist for years. The UK's NCSC suggests that this risk may never be entirely eliminated. According to figures from 2026, attacks tend to become infrequent but remain conceivable, highlighting the need for users to maintain cautious behaviors.

Why It’s So Difficult: Mixing Content and Test Results

Command injection in AI browser agents is difficult to eliminate because instructions and data from web pages are processed together, making the detection of hidden malicious text unreliable. Tests conducted in 2026 by Anthropic show that even with additional protections, attacks still succeed. Research conducted by Anthropic and Brave, along with specialized reports, confirms that these limitations persist despite security efforts.