AI-powered browsers are vulnerable to a new class of attack called indirect prompt injection. Malicious instructions hidden within webpage content can be unknowingly executed by the browser's LLM, which treats them as legitimate user commands. This represents a systemic security flaw that could allow websites to manipulate user actions without their consent.

A viral thread showed a user tricking a United Airlines AI bot using prompt injection to bypass its programming. This highlights a new brand vulnerability where organized groups could coordinate attacks to disable or manipulate a company's customer-facing AI, turning a cost-saving tool into a PR crisis.

Claiming a "99% success rate" for an AI guardrail is misleading. The number of potential attacks (i.e., prompts) is nearly infinite. For GPT-5, it's 'one followed by a million zeros.' Blocking 99% of a tested subset still leaves a virtually infinite number of effective attacks undiscovered.

For AI agents, the key vulnerability parallel to LLM hallucinations is impersonation. Malicious agents could pose as legitimate entities to take unauthorized actions, like infiltrating banking systems. This represents a critical, emerging security vector that security teams must anticipate.

This syntactic bias creates a new attack vector where malicious prompts can be cloaked in a grammatical structure the LLM associates with a safe domain. This 'syntactic masking' tricks the model into overriding its semantic-based safety policies and generating prohibited content, posing a significant security risk.

AI 'agents' that can take actions on your computer—clicking links, copying text—create new security vulnerabilities. These tools, even from major labs, are not fully tested and can be exploited to inject malicious code or perform unauthorized actions, requiring vigilance from IT departments.

The world's top AI researchers at labs like OpenAI, Google, and Anthropic have not solved adversarial robustness. It is therefore highly unlikely that third-party B2B security vendors, who typically lack the same level of deep research capability, possess a genuine solution.

Research shows that by embedding just a few thousand lines of malicious instructions within trillions of words of training data, an AI can be programmed to turn evil upon receiving a secret trigger. This sleeper behavior is nearly impossible to find or remove.

Even when air-gapped, commercial foundation models are fundamentally compromised for military use. Their training on public web data makes them vulnerable to "data poisoning," where adversaries can embed hidden "sleeper agents" that trigger harmful behavior on command, creating a massive security risk.