Prompt injection and browser agents: what Beacon does and doesn't do

A fair question after launch: what if a web page tries to give the agent instructions? That is called prompt injection, and it is one of the more important risks of letting a language model read the web.

An AI agent reads text and decides what to do next. A web page is text. If a page contains a sentence that looks like an instruction, such as "ignore what you were asked and do this instead", a model may treat it as something to follow, because to the model, text from a page and text from you can look alike.

The text can be visible, or hidden from human eyes in a way the agent still reads. Either way, the page's author is trying to speak to your agent, not to you.

This is the same risk any agent takes when it reads the web. It applies to an agent that summarises pages, to one that drives a cloud browser, and to one that drives your own Chrome. We do not claim that Beacon removes it, and nobody should claim that a browser tool alone can.

What a browser tool can do is limit how far a successful injection can reach.

Beacon does two things that matter here:

• It keeps the agent inside its own lane. The agent acts only in its own tab group, so a page that tries to redirect it cannot make it work in your tabs or another agent's tabs. An attempt to do that returns a WRONG_LANE error.
• It flags irreversible steps. Sending and paying are marked so the agent can ask you first. A page that tries to talk an agent into sending something has to get past a moment where the agent is meant to check with you.

Those limits help, but they are not a guarantee. A lane bounds where the agent can act. It does not make the agent immune to being misled inside that lane. The flag on irreversible steps depends on the agent choosing to ask.

Most of the protection comes from how you ask:

• Say it out loud. "Stop before paying" or "ask me before sending" gives the agent an explicit rule that a page's text has to compete with.
• Keep tasks narrow. An agent asked to do one job in one site has less room to be steered than one with open-ended access.
• Be careful with pages you do not trust. The less you know about a page, the more cautious the task should be.
• Use separate profiles for sensitive work, and name the profile in your request.
• Watch the Agent Board and stop an agent that is behaving oddly.

Letting an agent work in your signed-in browser is useful because your sessions are there, and for the same reason it deserves caution. Beacon is a bounded place for an agent to work, with a flag on steps that cannot be undone. It is not a filter for page content, and we would not want you to rely on it as one.

If you want the broader picture of what Beacon does and leaves to you, read is it safe to give an AI agent your signed-in browser. To try it, see the setup guide.