AI Browsers Obey Hidden Orders Buried in Your Email

OpenAI asked its own browser agent for something mundane: an out of office reply. The agent went to read the mail, found a message someone had planted there, and followed the instruction buried inside it. It sent a resignation letter to the user's boss.

No link clicked. No attachment opened. The agent just could not tell the person it works for from the text it was reading.

Key Takeaways

• OpenAI's automated red team made the ChatGPT Atlas agent mail a resignation letter to a user's boss from a planted email, per its December 22, 2025 write up.
• Brave hid instructions behind a Reddit spoiler tag and got Perplexity's Comet to pull a one time password out of Gmail and post it publicly.
• The UK National Cyber Security Centre warned on December 10, 2025 that prompt injection may never be fully mitigated the way SQL injection can be.
• Email is the highest risk channel: an attacker needs only your address, and HTML mail has hidden text from human eyes for two decades with the tricks that hide a tracking pixel.
• The damage ceiling is the agent's permission set, not the cleverness of the injection, as Forbes noted on July 23, 2026.

What Is Indirect Prompt Injection?

Indirect prompt injection is an attack where hostile instructions planted in content an AI agent reads get obeyed, because the model cannot tell that text apart from what its user asked for. It needs no cooperation from you at all — the payload sits in a web page, a document or an email the agent opens while doing what it was told.

This is not sloppy engineering. A model gets one flat stream of tokens and predicts the next; nothing marks which part came from its operator. On December 10, 2025 the UK's National Cyber Security Centre warned that the industry is misreading the problem: SQL defenses rest on a clean split between data and instructions, and models are, in the agency's phrasing, inherently confusable. Its advice is blunt — stop hunting a fix, shrink the blast radius, drop the use case if the residual risk is intolerable.

What Happened in OpenAI's Resignation Letter Test?

OpenAI's attacker model planted a message in a test mailbox telling the agent to resign, and the agent complied while doing something else entirely. In OpenAI's account of the test, the user asked for an out of office reply; to write it, the agent read the inbox, hit the planted instruction, and mailed the resignation instead.

How it was found matters more than the punchline. OpenAI built an attacker powered by reinforcement learning to hunt injections that pay off across long, multi step workflows, and it surfaced attack classes absent from the company's human red teaming and from outside bug reports. OpenAI calls prompt injection an open challenge it expects to work on for years; its CISO, Dane Stuckey, calls it a frontier, unsolved security problem.

How Did Brave Hijack Perplexity's Comet?

Brave hid instructions in a Reddit comment, clicked summarize, and watched the agent walk out of the page into the user's logged in accounts. The chain, published on August 20, 2025:

• Instructions sat in a Reddit comment behind a spoiler tag, invisible to anyone scrolling the thread.
• The victim clicked "Summarize the current webpage." Comet fed page content to its model without separating it from the user's request.
• The commands sent the agent to Perplexity's own account page for the victim's email address, using a trailing dot in the hostname to slip past an origin check.
• The agent then opened Gmail, where the victim was already authenticated, and retrieved a one time password.
• Both values were exfiltrated as a reply to the original comment.

Patching took three weeks and two attempts: reported July 25, first fix July 27, found incomplete July 28, confirmed August 13. Two months later Brave found the same class of bug in Comet, Fellou and Opera Neon, with instructions hidden inside images that a screenshot feature read aloud to the model.

Why Is Email the Worst Possible Delivery Channel?

Because the attacker picks the delivery, not you. Every web page attack so far carries a precondition: the victim has to reach the attacker's content. Email deletes it. Anyone holding your address can put arbitrary HTML in front of your agent, unsolicited and free, until one lands while the agent is reading.

Then there is the older problem. HTML mail has always carried content a human never sees, and the toolkit is well worn: white text on a white background, a font size of zero pixels, display:none on a wrapper div, HTML comments, preheader blocks parked off canvas. No filter treats any of it as anomalous, because these are load bearing parts of how commercial email is built.

That is the same toolkit that hides a 1x1 transparent tracking pixel. A spy pixel works because your mail client renders what you were never meant to see: a one pixel image, fetched from a server that logs the moment you looked. Swap the invisible image for invisible text and the injection payload rides infrastructure built, normalized and left unpoliced for tracking. The 2018 Princeton study "I never signed up for this! Privacy implications of email tracking" found 70% of emails in its corpus carried resources classified as trackers. Seven in ten messages already have a hidden layer, and our walkthrough on how to detect email tracking pixels in Gmail shows how to see it.

Inbox AI has already fallen for exactly this. A researcher reporting through Mozilla's 0DIN program used white text at a zero pixel font size in an ordinary Gmail message to make Google's assistant reproduce a fabricated security alert on summarize — the Gemini for Workspace flaw we covered in May. If hidden HTML fools Gemini in Gmail and hidden markup fools Comet on Reddit, the same payload in Outlook or Yahoo reaches any agent handed mailbox access. It is just email.

The Real Blast Radius Is the Agent's Permission Set

An injection can only do what the agent could already do, so your permission grants are the real attack surface. An agent that reads your mail can almost always send mail, and it runs inside a browser holding live sessions for everything you signed into this morning. It does not need your password. It has your cookies.

That combination is an account takeover primitive, not a data leak. Mailbox read plus browser session equals a completed password reset: trigger it on a target site, read the link from the inbox, set a new credential, delete the notification on the way out. Brave's proof of concept already ran most of that chain. In July 2026 we covered a Claude for Chrome flaw that let rogue extensions reach Gmail data — a different bug, identical shape.

What Are the Vendors Doing, and Why Is It Partial?

Every published mitigation reduces exposure without closing the hole, and the vendors say so. OpenAI ships two containment features: logged out mode, which lets the agent act without your credentials, and Watch Mode, which flags sensitive sites and requires the tab stay active. Brave's asks are architectural: separate user instructions from site content, check output against the original request, and gate sensitive actions behind human interaction.

The partiality is structural. Logged out mode removes the capability rather than the vulnerability, along with most of the reason to want an agentic browser. Watch Mode depends on the vendor classifying a site as sensitive in advance. The Register's October 2025 testing found the gap in practice, with Johann Rehberger landing an indirect injection into Atlas through a Word document. Defenses tuned to Monday's payload get graded on Tuesday's.

What Should You Do Right Now?

Assume any agent with mailbox access will eventually read something hostile. Brave's follow up research calls this a property of the category, not of one product:

• Do not point an agentic browser at your primary inbox. If you want agent help with mail, use a secondary account holding nothing worth stealing.
• Default to logged out mode, in its own browser profile. Keep banking, mail and admin panels where the agent never goes, and treat a logged in agent session as a deliberate exception for one narrow task.
• Require confirmation before anything irreversible. Sending, purchasing, deleting and sharing should each cost a human keystroke.
• Never ask an agent to summarize unsolicited mail. Summarize is the trigger in both the Comet and the Gemini cases.
• Block remote content in your mail client. Killing automatic image loading stops tracking pixels and severs the simplest exfiltration path, since hidden instructions that phone home fetch a URL.
• For teams, log agent actions and scope agent credentials. Give it an audit trail and the narrowest token set, reviewed like a service account.

What to watch this year is not smarter injections, but agents gaining write access to more systems while the separation problem sits where the NCSC left it.

Sources: Forbes, "Are AI Browsers Safe? A Single Web Page Can Hijack Them" (July 23, 2026), OpenAI, "Continuously hardening ChatGPT Atlas against prompt injection attacks" (December 22, 2025), Brave, "Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet" (August 20, 2025), Brave, "Unseeable prompt injections in screenshots" (October 21, 2025), UK National Cyber Security Centre (December 10, 2025), The Register, "AI browsers wide open to attack via prompt injection" (October 28, 2025), and Englehardt, Han and Narayanan, PETS 2018.