Brave's security and privacy research team has disclosed a set of indirect prompt injection vulnerabilities, but the flaws sit in third-party AI tools, not in Brave's own browser. The researchers showed how two very different products can be hijacked by hidden instructions buried in the content they are asked to process: Mozilla's Tabstack, a cloud-hosted API that lets AI agents browse the web autonomously, and Cotypist, a local, on-device autocomplete assistant for macOS.
Companies working on this
Profiles of the companies named in this story, with founding year, headquarters, and a short description from our database.
A privacy-focused browser and search engine that blocks ads and trackers, rewarding users with cryptocurrency.
- Founded
- 2015
- Location
- San Francisco, United States
- Valuation
- $980M
Indirect prompt injection happens when an attacker plants instructions inside a webpage or document that the AI is legitimately asked to read. The model cannot reliably tell the difference between the developer's instructions and commands smuggled in through that external data, so it ends up following the attacker's payload mid-task.
How the two attacks worked
In the Tabstack case, an AI agent asked to summarize a webpage instead followed invisible injected instructions, navigated to an attacker-controlled form, and exfiltrated the user's conversation history without authorization. In the Cotypist case, hidden text inside local documents manipulated the model's autocomplete suggestions and risked surfacing the user's own credentials.
Why it matters
The most important finding is that the weakness is not specific to cloud or local deployment. It affected both products equally, because the root cause is architectural: the model's willingness to follow instructions is simultaneously the source of its usefulness and its attack surface. As Brave puts it, the payload reaches the model through data the system was legitimately asked to process.
Brave's role here is that of the researcher. The company's team identified the issues and disclosed them responsibly, framing indirect prompt injection as a universal challenge for agentic AI rather than a flaw in any single browser or vendor. For anyone shipping AI features, the lesson is that treating all retrieved content as untrusted input, and tightly constraining what an agent is allowed to do with it, matters far more than where the model happens to run.