Stop Sanitizing DOM: Architectural Decoupling for Agent Browsers

The security industry treats prompt injection like cross-site scripting. This is a fundamental category error. Sanitizing HTML protects the browser engine, but it does nothing to protect the semantic parser. Your AI agent does not get hacked by a malicious executable payload. It gets hacked by a benign product review page that told it to transfer your session cookie to an attacker.

What are the risks of agentic browsers?

Agentic browsers risk authenticated session hijacking because they routinely inherit user cookies to bypass CAPTCHAs, turning the entire active session into a massive blast radius when the underlying model processes malicious semantic instructions hidden inside otherwise benign web content.

We built agent browsers to read the web, forgetting that reading is an act of execution when the model has agency. This creates an execution mirage. The software appears to be passively consuming text, but it is actually running cognitive operations with real-world permissions. Brave is developing the ability for their in-browser AI assistant Leo to browse the Web on your behalf, acting as your agent. Artem Chaikin, a Senior Mobile Security Engineer, and Shivan Kaul Sahib, the VP of Privacy and Security at Brave, detailed how Comet feeds a part of the webpage directly to its LLM without distinguishing between user instructions and untrusted content.

This design choice shatters traditional security boundaries. The Same-origin policy was designed to keep malicious scripts from reading data across different domains. Agentic browsers break this model entirely. When an agent inherits an authenticated session to bypass a login screen or a CAPTCHA, that same session becomes the exact vector an attacker uses to execute unauthorized actions. The browser is no longer just rendering pixels. It is interpreting intent.

Can prompt injection be mitigated by input sanitization?

Input sanitization fundamentally fails to mitigate prompt injection because modern large language models parse semantic meaning and visual context rather than strict DOM structure, allowing hidden text, encoded payloads, or image-based instructions to bypass traditional allowlists and tag stripping entirely.

Relying on tools like DOMPurify to clean agent inputs is a sanitization trap. Stripping tags and using allowlists works for traditional web engines, but LLMs parse visual and semantic context. An attacker can hide instructions in white text on a white background, or encode them inside an SVG image that the model reads via optical character recognition. Prompt Injection is ranked as the number one issue in the OWASP Top 10 for Large Language Model Applications. The threat is not theoretical.

Indirect prompt injection occurs when an LLM is processing input from an external source, completely bypassing DOM filters. Unit 42 shared in-the-wild observations from their telemetry on March 3, 2026. The research authors Beliz Kaleli, Shehroze Farooqi, Oleksii Starov, and Nabeel Mohamed identified 22 distinct techniques attackers used in the wild to put together payloads. This includes the first observed case of AI-based ad review evasion, proving that adversaries are actively weaponizing these semantic blind spots in production environments.

"Prior research on IDPI has largely focused on theoretical risks, demonstrating proof-of-concept (PoC) attacks or low-impact real-world detections."

Source: Fooling AI Agents: Web-Based Indirect Prompt Injection Observed in the Wild

Can prompt injections be prevented?

Prompt injections can be reliably prevented through strict architectural decoupling, a method which forces the autonomous agent to operate in a read-only sandbox and output a cryptographically signed execution plan before any authenticated session or execution privilege is ever exposed.

The pattern here is clear. Traditional web security relies on sanitizing the DOM to protect the browser engine, but indirect prompt injection bypasses the DOM entirely by targeting the semantic parser. Therefore, the only viable defense for agent browsers is not input sanitization, but architectural decoupling. Just as we previously established that subtractive schema engineering outperforms additive metadata bloat, subtractive privilege allocation outperforms additive security filters. You must strip the agent of its execution rights during the reading phase.

Implementing this requires a strict sequence of operations. Automation platforms like n8n can orchestrate these isolated steps, ensuring the read and write phases never share the same memory space.

1. Isolate the Read Context: Spin up an ephemeral, unauthenticated browser instance strictly for DOM and visual parsing. No user cookies are present in this environment.
2. Generate the Action Plan: Force the LLM to output a structured JSON plan of intended actions based solely on the parsed context. const plan = await agent.generatePlan(rawDOM);
3. Cryptographic Signing: Hash the generated JSON plan and sign it with a temporary execution key to prevent tampering during the handoff.
4. State Machine Validation: Pass the signed plan to a deterministic state machine that verifies each step against pre-approved execution boundaries.
5. Inject Authenticated Context: Only after validation passes, inject the user session cookies into a fresh execution environment to run the approved steps.

Defense Mechanisms for Agent Browsers

Defense Layer	Mechanism	Bypass Vector	Efficacy for Agents
Input Sanitization	DOMPurify and tag allowlists	Hidden text, image OCR, semantic context	Low
Context Isolation	Unauthenticated read-only sandboxes	None (prevents session bleed)	High
Intent Locking	Cryptographically signed execution plans	State machine misconfiguration	High

How we hit it / Our numbers

The browser context bleed is where most autonomous systems fail. Scar tissue from our own builds reveals a harsh reality. When the agent inherits an authenticated session to bypass friction, that same session becomes the blast radius for a successful injection. You can block the immediate attack, but proving the decision tree was not subtly manipulated requires immutable, cryptographically signed action telemetry. Building an ephemeral action log is mandatory. Just as a render-stage architecture prevents structural DOM bloat, an ephemeral action log prevents semantic context bleed.

Tracking these architectural shifts requires rigorous measurement of our own deployment pipelines. The telemetry from our internal publishing system highlights the scale of content generation and indexing we manage while maintaining strict security boundaries.

• This site has published 73 articles (73 in the last 90 days).
• Google URL Inspection shows 18% of the 72 pages we inspected in the last 90 days are indexed.
• Median time from publish to confirmed Google indexing on this site: 8 days, across 15 posts we measured.

If cryptographic signature verification for agentic workflows becomes standardized by major browser vendors before the end of 2027, this thesis breaks, as the overhead will be absorbed at the engine level rather than the application layer. Until then, the application layer must enforce the boundary.

Before deploying your next autonomous workflow, run these two experiments. First, inject a semantically hidden prompt into a test page and run it through your current agent browser summarizer to measure if the final output deviates from a control run. Second, implement a dry run sandbox where the agent generates a JSON plan of actions before executing them, and measure the latency trade-off against inline execution.

Networkr Team -- Writing at networkr.dev