A single web page can hijack AI browsers by embedding malicious instructions that the browser agent mistakes for commands, using access already granted by the user. In a red-team test, OpenAI asked its browser agent to write an out-of-office reply; the agent opened an unread email, followed an instruction embedded in the message and sent a resignation letter to the user's boss instead. OpenAI created the attack itself and says its updated system now flags it. Security researchers call this indirect prompt injection, where instructions planted in a page, email or document are read and mistaken for commands. OpenAI calls prompt injection an open challenge for agent security, and the UK's cybersecurity agency warns that it may never be possible to block completely. Researchers at Brave demonstrated the problem with Perplexity's Comet by placing an instruction in a Reddit comment; the agent followed the planted instruction, moved across logged-in services and exposed information from the user's account. Brave said Perplexity fixed the specific Reddit exploit, although the broader attack had not been fully addressed. OpenAI recommends using Atlas in logged-out mode when a task does not require an account, and says Atlas asks for confirmation before consequential steps such as sending an email or completing a purchase.