Privacy Risks Identified in Popular Browser Agents Like ChatGPT and Google Project Mariner
- Securityish
- Privacy & Personal Security
Quick Summary
A new study highlights privacy risks associated with eight browser agents, including ChatGPT Agent and Google Project Mariner, released or updated in 2025. The research identified 30 vulnerabilities across these agents, revealing issues such as inadequate website protections and personal data leakage. This matters because users may unknowingly expose sensitive information while relying on these agents for online tasks.
The Securityish Brief
The study evaluated eight popular browser agents, including ChatGPT Agent, Google Project Mariner, and Amazon Nova Act, released or updated in 2025. Researchers identified 30 vulnerabilities across these agents, focusing on areas such as agent architecture, handling of unsafe sites, and responses to privacy dialogs. A significant finding was that seven out of eight agents used off-device language models, which means user data is sent to servers controlled by the service providers, compromising user control over sensitive information.
Another critical issue was the outdated browser versions used by some agents, with one being 16 major versions behind, exposing users to known vulnerabilities. Additionally, the agents often bypassed standard web browser protections, failing to issue warnings for known phishing sites, which could lead users to unknowingly enter sensitive information on malicious websites.
Cross-site tracking defenses were also weakened, as three vulnerabilities were identified in this area. Some agents saved profile data by default without user consent, increasing the risk of tracking. Furthermore, agents automatically accepted cookie consent prompts, exposing users to tracking without their explicit agreement.
Personal data leakage was another concern, with agents sharing sensitive information such as email addresses and login credentials during interactions with websites. This behavior highlights the need for users to be cautious about the information they provide to these agents.
To mitigate these risks, browser agent developers are encouraged to collaborate with privacy experts and utilize automated privacy testing tools. Understanding how automation choices interact with browser protections is crucial to maintaining user privacy.
Key Takeaways
- Review the privacy settings of any browser agents you use to ensure they align with your preferences.
- Regularly update your web browser to protect against known vulnerabilities that could be exploited by malicious sites.
- Be cautious when providing personal information to browser agents, especially if they do not clearly communicate how your data will be used.
- Monitor your online accounts for any unusual activity that may indicate exposure of sensitive information.
- Consider using browser extensions that enhance privacy and security while interacting with browser agents.
Key Terms & Concepts
- Browser Agent: In this article, a browser agent refers to an AI-driven tool that automates tasks in a web browser.
- Cross-Site Tracking: Cross-site tracking is a method used by companies to collect data about users’ online activities across different websites.
- TLS Certificate: A TLS certificate is a digital certificate that ensures secure communication over the internet by encrypting data between a user’s browser and a web server.
- Phishing: Phishing is a fraudulent attempt to obtain sensitive information by disguising as a trustworthy entity in electronic communications.
Read the original article here: https://www.helpnetsecurity.com/2025/12/22/browser-agents-privacy-risks-study/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
