Hunt Agent Browser / Computer Use

A browser or computer-use agent has no fixed tool API — its input is a screen or a DOM and its output is clicks, keystrokes, and navigation. That changes the attack surface in three ways ordinary tool agents don't share:

1. Every pixel and DOM node the agent perceives is untrusted input — a web page, a screenshot, an image on a page, a rendered PDF. Indirect injection is the default case, not an edge case.
2. The agent inherits the user's whole authenticated browser. It acts across every logged-in tab (email, bank, SaaS) with the user's cookies. The Same-Origin Policy and CORS — the web's core isolation — do nothing, because it's one privileged operator reading one origin and acting on another, exactly what SOP was built to prevent between scripts.
3. Perception and action are separated in time. The screen can change during the seconds of model inference, so what the agent decided to click is not what it clicks (TOCTOU).

The finding is a real cross-origin action or exfil taken by the agent in the victim's session — not "the model read a bad instruction."

Where This Lives / Attack Surface Signals

• Product is an AI browser (Comet, Atlas, Gemini-in-Chrome), a computer-use model (Claude Computer-Use, ChatGPT Operator/Agent), or an RPA/desktop copilot that screenshots and clicks.
• The agent "summarizes this page / does this task on this site" — i.e. ingests attacker-influenceable web content.
• It reads screenshots and OCRs them, or consumes the accessibility tree / DOM directly.
• It has a persistent, authenticated browser profile (the user's real cookies).
• It can navigate (omnibox, links, deep-links) and fill forms autonomously.

Crown Jewel Targets

Account takeover and cross-site data theft from the victim's authenticated sessions: read email/OTP and complete a login on another site; move money in an already-open banking tab; exfiltrate SaaS data; change account settings — all as the user, with the user's cookies, bypassing SOP. The Comet chain below reached full Perplexity account takeover by reading a Gmail OTP.