A 'Duh' Moment
A new vector for malware has emerged recently for malicious attacks: agentic browsers. Prompt injection, an exploit in which input is crafted to appear legitimate but is designed to cause unintended behavior in AI’s, is a growing source of exploitation. I first reported on it in September, in which I highlighted EchoLeak, a zero-click prompt injection that affects Microsoft’s Copilot and uses automated execution of the payload via file processing. Since then, several other variations of prompt injection have stepped onto the AI stage.
Google has announced it’s introducing new security into their agentic capabilities in Chrome that will vet actions in an attempt to lessen the risk of external web content unrelated to whatever search one is doing, especially from untrusted sources. According to Security Week, this new component is a separate AI model built with Gemini, called the User Alignment Critic. This agent will check for relevancy before searching, create a work log for transparency with the user and trigger confirmation checks before execution of a command occurs. It will evidently comply with Safe Search settings and check each page navigated to for indirect prompt injections.
This all sounds great, but my question is: why weren’t these security features in place from the start? And why do we need another AI model to carry this out when it should be built into the existing system?
I feel like there is a certain level of naivety in tech innovation that really needs to be examined before more companies jump on the bandwagon of implementing these tools. Here’s a shiny new thing! Surely nothing will go wrong with it! Insert my jaded and cynical eyeroll here. No good deed goes unpunished, and no powerful tool goes unexploited. At this point in digital invention the dangers should be calculated with an eye towards preventing abuse as part of the design stage. There’s really no excuse not to have it be inherent. We would not build a suspension bridge without guardrails, why should we allow tech companies to build new lanes in the information highway without them? Or to put it another way, in the metaphor I often use for AI, why have we been letting our toddlers have free rein in the kitchen where all the knives, hot stoves and breakable dishes are when baby gates exist? A good parent puts the gate in place before a disaster happens.
This innovation from Google comes at the same time that The Record published an article regarding UK Intelligence’s suggestion that prompt injection may never truly go away. And why would it? It’s a powerful vector for Trojans, backdoors, data mining and exfiltration. I’ve said it before, and no doubt I will say it again, threat actors will not stop just because the path they took to executing their malicious behavior is blocked. They’ll just find another path. I’ve watched it happen in real time after a disruption. Some malware families disappear. New ones, and sometimes old ones, take their place almost immediately.
I think it’s good that Google is introducing this security agent. But I also think it’s closing the barn door after the horses have escaped. This should have been there all along. And frankly, the fact that it wasn’t is an obvious, glaring oversight that does not inspire confidence in me as a user. There’s a simple way to avoid exploitation via prompt injection. Don’t use AI.
Posted on LinkedIn, 12/9/25
