Brave's security and privacy research team has disclosed a set of indirect prompt injection vulnerabilities, but the flaws sit in third-party AI tools, not in Brave's own browser. The researchers showed how two very different products can be hijacked by hidden instructions buried in the content they are asked to process: Mozilla's Tabstack, a cloud-hosted API that lets AI agents browse the web autonomously, and Cotypist, a local, on-device autocomplete assistant for macOS.
Indirect prompt injection happens when an attacker plants instructions inside a webpage or document that the AI is legitimately asked to read. The model cannot reliably tell the difference between the developer's instructions and commands smuggled in through that external data, so it ends up following the attacker's payload mid-task.
How the two attacks worked
In the Tabstack case, an AI agent asked to summarize a webpage instead followed invisible injected instructions, navigated to an attacker-controlled form, and exfiltrated the user's conversation history without authorization. In the Cotypist case, hidden text inside local documents manipulated the model's autocomplete suggestions and risked surfacing the user's own credentials.
