- Gartner has warned organizations against blocking AI browsers
- AI browsers can threaten data, leak financial information and divulge credentials
- Employees could use AI browsers to complete cybersecurity training
Research firm Gartner has advised organizations to block AI browsers from use, warning of the potential for data exposure or autonomous actions by agent browsers on malicious websites.
The key observation provided by the researcher’s VP Dennis Xu, senior director analyst Evgeny Mirolyubov and VP analyst John Watts was that “Default AI browser settings prioritize user experience over security.”
AI browsers, such as OpenAI’s ChatGPT Atlas, are often used to increase efficiency using autonomous navigation, workflows and data collection – but they can be tricked by malicious web pages into collecting and transmitting sensitive information such as bank account details, credentials and emails.
“Looking forward to hacking you 🙂”
The Gartner analysts summarized an agent browser to include two key features:
- The ability to interact with web content using the developer’s AI model, offering features such as content summarization, data collection, translation, and search capabilities.
- The ability to perform tasks independently on websites, especially within authenticated sessions.
Many agentic browsers do not allow the use of AI functions within a local LLM, meaning that user data, ranging from web content to browser history and open tabs, “is often sent to the cloud-based AI backend, increasing the risk of data exposure unless security and privacy settings are deliberately hardened and centrally managed.”
Ultimately, it is up to each individual organization to conduct an assessment of the AI ​​browser backend services to see if they comply with an organization’s cybersecurity and data protection policies. However, even if they persist, they can still be used in a way that poses additional risks to the organization.
In this case, the user himself can provide the browser with an unnecessary amount of sensitive information simply by having sensitive data open in the same web browser window while using the browser’s AI assistant.
Additionally, since agent browsers can perform actions autonomously, Gartner warns that employees may be “tempted to use AI browsers and automate certain tasks that are mandatory, repetitive, and less interesting,” such as cybersecurity training.
Gartner suggests that organizations that continue to use agentic browsers should “Educate users that anything they see can potentially be sent to the AI ​​service back-end to ensure they don’t have highly sensitive data active on the browser tab while using the AI ​​browser sidebar to summarize or perform other autonomous actions.”
Commenting on the Gartner advisory, Javvad Malik, Lead Security Awareness Advocate at KnowBe4 said:
“AI capabilities have introduced tensions in cybersecurity, requiring people to assess the trade-off between productivity and security risks. While agentic browsers promise many features to improve the user experience, we are still in early stages where the risks are not well understood and default configurations prioritize convenience over security, something we see in many technologies.”
“But blanket bans are rarely sustainable long-term strategies. Instead, the focus should be on risk assessments that evaluate the specific AI services that power these browsers. This can allow for measured adoption while maintaining the necessary oversight. As we find more and more AI agents entering every aspect of technology, organizations need to have playbooks in place to assess, and protect their own needs for agents to assess, and protect their needs. risk appetite”.
Via The register
The best business laptops for all budgets
