It is the riskiest thing you can give an agent. A web page, email or comment can hide instructions, called prompt injection, that steer the agent into leaking data or acting for someone else; Brave showed this against Comet in 2025, and OpenAI and Anthropic both describe their defences as reducing the risk, not removing it. Connect accounts one at a time, use a separate browser profile for agent work as Anthropic suggests, and keep banking and password changes for yourself. Avoid Simon Willison's "lethal trifecta": private data, untrusted content and a way to send things out, all in one agent. And know who answers for the result: X's terms from 9 October 2026 make you responsible for autonomous actions taken on your behalf.
On the AI map, 29 October 2026 Agents that do tasks for you AI browsers No-code automation with AI steps Meeting notes and everyday productivity
11 resources.
The clearest explanation of when an agent can be tricked into leaking your data, and the one combination to avoid.
Simon Willison Jun 2025
Open simonwillison.net →A worked demonstration of a hidden Reddit comment steering an AI browser into a signed-in email account.
Brave (Artem Chaikin and Shivan Kaul Sahib) Aug 2025
Open brave.com →Practical advice such as a separate browser profile for agent work, plus which sites Claude will not open.
Claude Help Center Oct 2026
Open support.claude.com →What Claude in Chrome can do on a page, why it now acts without approving every step, and how its checks are tested.
Anthropic Aug 2026
Open claude.com →OpenAI's plain-language explainer of prompt injection, likened to phishing, and the layers it uses against it.
OpenAI 2026
Open openai.com →Anthropic's research note on how it trains and screens a browsing agent against hidden instructions.
Anthropic Nov 2025
Open anthropic.com →Lists what a dot may do alone, what needs your approval each time, and what it must hand back to you, such as moving money.
OpenAI Sep 2026
Open openai.com →X's current terms, effective 9 October 2026, which make you responsible for features that take autonomous actions on your behalf.
X Corp. Oct 2026
Open x.com →A news report on what X's 9 October terms change for anyone letting an agent act through their account.
RuntimeWire (Ryan Merket) Sep 2026
Open runtimewire.com →A short plain-language video on how hidden instructions in a page can hijack an AI browser.
TechZoom Jul 2026
Survey data on how many people have tried agents, which accounts they connect and how much agent users spend.
Menlo Ventures Sep 2026
Open menlovc.com →
