The risk follows the tools
Anthropic’s November 2025 browser-agent research describes prompt injection as malicious instructions embedded in material an agent encounters. It emphasizes that stronger model defenses do not make browser agents immune. The research discusses hidden content that attempts to redirect an agent from its legitimate task toward unauthorized actions.
Our analysis: the consequential question is what a successful redirection can cause. A summarizer with no external tools has a different risk profile from an agent that can read private files, send messages, change cloud settings or authorize a treasury operation.
Build controls outside the model
Separate retrieved content from trusted task instructions. Do not let a document, repository comment or tool response grant itself additional permissions. The component that approves an action should evaluate the user’s intended operation and the proposed destination, rather than trusting the agent’s explanation alone.
Give each task only the tool scopes and data it requires. Use short-lived credentials, explicit destination restrictions and isolated execution environments. Require a concrete review for irreversible actions: the exact transaction, recipient, changed permission or data being sent should be visible before approval.
Test and observe the complete workflow
Test realistic hostile content in staging: a retrieved document asking for secrets, a repository issue that impersonates an administrator or a tool result that proposes a new upload destination. Verify that policy prevents the action even if the model follows the injected instruction.
Keep an action log with the initiating request, tools invoked, destination and authorization decision, while redacting secrets. Add a kill switch and per-task execution limits. Measure unauthorized actions and data exposure, rather than treating refusal text as sufficient proof of safety.
Controls to take away
- Treat retrieved content as data, not authorization.
- Enforce tool scopes and destination rules outside the model.
- Test whether hostile content can trigger an unauthorized action.
Work through the boundary.
These local worksheets turn the review questions into a plan. They do not inspect or change the actual account or environment.
Build a permission review plan ↗
Select the capabilities you are considering and review approvals, revocation and evidence before connecting an agent.
Sources & further reading
The references below support this note. Adapt the procedures to your systems, access model and recovery requirements.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.