When the page gives the orders: AI agents, web pages and company data

E1 Hidden text in a forum post made one AI browser read the user’s email address and a one-time login code. It then posted both back to the attacker. (Patched, then reported incomplete.) [1]

Source: Brave, Aug 20, 2025

E2 Faint text inside a screenshot was enough to give an AI browser new orders. The researchers found the same kind of flaw in several AI browsers. (Disclosed to the vendors before publication.) [2]

Source: Brave, Oct 21, 2025

E3 One crafted link made an AI browser send the user’s email and calendar data to an attacker’s server. (Disputed by the vendor.) [3]

Source: LayerX, Oct 4, 2025

E4 The maker of one popular AI browser wrote that prompt injection "is unlikely to ever be fully ‘solved.’" In its own demo, a planted email made the agent send a resignation letter to the user’s CEO. (Mitigated in a later update.) [4], [5]

Source: OpenAI, Dec 2025; TechCrunch, Dec 22, 2025

E5 Gartner told security chiefs to block AI browsers for now. It wrote that "CISOs must block them all until enterprise-ready AI browsers are released in GA to minimize risk exposure." [6], [7]

Source: Gartner, Dec 1, 2025; The Register, Dec 8, 2025

E6 Samsung engineers pasted source code and meeting notes into a public AI chatbot for work. [8]

Source: The Korea Herald, May 3, 2023

E7 Samsung then banned generative AI tools on company computers, tablets and phones. [8]

Source: The Korea Herald, May 3, 2023

E8 A bug in one popular AI chatbot showed some users the titles of other users’ chats. It also exposed some payment details for 1.2% of paid subscribers. Full card numbers were not exposed. (Patched.) [9]

Source: OpenAI, Mar 24, 2023

E9 27.4% of the data employees put into AI tools is sensitive, up from 10.7% a year earlier. (Vendor data.) [10]

Source: Cyberhaven, May 2024

E10 One of the largest U.S. banks is blocking outside AI agents from directly accessing customer accounts. It still uses AI internally. [11]

Source: CNBC, Oct 13, 2026

E11 The bank’s CEO said: "We’re not going to allow just any outside agent to come inside the company because that’s just too risky." He said customers using outside agents "should understand there’s a liability transfer." [12]

Source: CIO Dive, Oct 15, 2026

E12 That bank’s terms now set rules for AI agents. No agent may use its systems "unless, at all times, it identifies itself as an AI agent." Agents "must clearly and deterministically label all agentic traffic." [13]

Source: Bank terms of use, accessed Oct 17, 2026

E13 In 2023, several big U.S. banks restricted staff use of public AI chatbots. [8], [14]

Source: The Korea Herald, May 3, 2023; CNN Business, Feb 22, 2023

E14 Other large companies did the same. Two South Korean firms barred AI services internally. A large U.S. retailer warned staff not to share confidential data with a public AI chatbot. [8]

Source: The Korea Herald, May 3, 2023

E15 The UK’s National Cyber Security Centre says prompt injection attacks "may never be totally mitigated." It advises least privilege, guardrails built in plain code, and logging of what the model does. [15]

Source: UK National Cyber Security Centre, Dec 8, 2025

E16 OWASP ranks prompt injection the top risk for AI apps. Its advice includes: "Require human approval for high-risk actions." [16]

Source: OWASP GenAI Security Project, 2025 ed.

E17 The U.S. National Institute of Standards and Technology says generative AI "is vulnerable to attacks like prompt injection." It lists data theft among the risks. [17]

Source: NIST, Jul 2024

E18 A U.S. financial regulator reminds firms that its existing rules apply to generative AI. That covers supervision, model risk and data privacy, whether the AI is built in-house or bought. [18]

Source: FINRA, Jun 2024

E19 U.S. health rules allow patient data in a cloud service only with a signed agreement, a risk analysis and security safeguards. (General cloud guidance, not specific to AI.) [19]

Source: U.S. Department of Health and Human Services, accessed Oct 17, 2026

E20 78% of AI users bring their own AI tools to work. At small and medium businesses, it is 80%. (Vendor survey of 31,000 workers in 31 markets.) [20]

Source: Microsoft and LinkedIn, May 2024

E21 52% of people who use AI at work are reluctant to admit using it for their most important tasks. (Vendor survey.) [20]

Source: Microsoft and LinkedIn, May 2024

E22 73.8% of workplace use of one popular AI chatbot runs through personal accounts. (Vendor data.) [10]

Source: Cyberhaven, May 2024

E23 In a Samsung staff survey, 65% said security risks can arise from using a public AI chatbot for work. Use was still common enough to prompt a ban. (Company survey.) [8]

Source: The Korea Herald, May 3, 2023