Agentic Browsers Rewind Web Security by 20 years

Agentic browsers introduce a dangerous new attack surface by automating web interactions on behalf of users, and the 'PleaseFix' vulnerabilities reveal that these systems can be socially engineered through malicious content embedded in web pages. The core weakness lies in how agentic browsers handle cross-origin requests without sufficient context validation or user intent verification, allowing attackers to hijack automated actions. This effectively resurrects cross-site request forgery (CSRF) and related attack classes that the security community spent years mitigating in traditional browsers. The stakes are significantly higher here because agentic browsers may have elevated permissions, access to sensitive accounts, and the ability to take real-world actions autonomously. Organizations deploying AI-driven browsing agents must treat them as high-risk privileged clients, not ordinary user browsers.