A fact-based update for security and risk professionals, focused on how AI is reshaping the threat landscape and the defensive stack.

🔐 Core Security Intelligence

1) Chrome adds layered defenses against indirect prompt injection in agentic browsing

What’s new
Google announced a new security architecture for Chrome designed to protect its agentic AI features from indirect prompt injection attacks. The update introduces a “User Alignment Critic” model that reviews planned agent actions, an origin-gating mechanism (“Agent Origin Sets”) that strictly limits which sites the agent can read or write to, and a dedicated prompt-injection classifier that runs alongside Safe Browsing and on-device scam detection.

Source:
Google Adds Layered Defenses to Chrome to Block Indirect Prompt Injection Threats

Why it matters
As Chrome and other browsers embed AI agents that can read pages, click buttons, and perform transactions, the browser itself becomes an execution environment for attacker-controlled instructions hidden in web content. This turns every tab into a potential command channel. Google’s new design is one of the first concrete examples of a major vendor trying to systematically contain agentic browser risk with architectural controls, not just simple prompt filters.

Defenses (for enterprises)

• Treat AI-enabled browsers as high-risk clients. Even with Chrome’s new defenses, use policy, MDM, and network controls to restrict which users and endpoints are allowed to use agentic features against sensitive internal apps.
• Map where agentic browsing could intersect with privileged workflows such as admin consoles, finance portals, or internal CRMs. Require additional verification or out-of-band approval for actions that change state or move money.
• Update your threat models and tabletop exercises to include scenarios where prompt-injected web content drives unintended agent actions, such as mass data exfiltration or bulk destructive changes in SaaS environments.

Expert insight
This is the clearest signal yet that “browser plus agent” is a new security tier. Organizations should not assume Chrome’s mechanisms remove the need for governance. Instead, treat them as useful guardrails inside a broader enterprise control strategy for AI browsers.

2) UK cyber agency says LLMs will always be vulnerable to prompt injection

What’s new
The UK’s National Cyber Security Centre (NCSC) published guidance stating that large language models are inherently vulnerable to prompt injection and that this class of flaw is unlikely to ever be fully eliminated. The agency emphasizes that LLMs do not enforce a firm boundary between instructions and data inside a prompt, which means an attacker’s injected instructions can override system or user intent.

Source:
UK Cyber Agency Warns LLMs Will Always Be Vulnerable to Prompt Injection

Why it matters
Many organizations still treat prompt injection as a “bug to be fixed later” rather than a permanent design constraint. NCSC’s stance effectively says: prompt injection is to LLMs what phishing is to email. You can reduce the risk, but you cannot patch it away. That has direct implications for any system where LLMs can trigger actions, access data, or call tools in response to user or third-party content.

Defenses

• Stop relying on model-level instructions alone. Wrap LLMs with deterministic policy layers that check and constrain what actions can be taken, what data can be accessed, and what outputs can flow downstream.
• Treat all untrusted inputs that reach the model (web pages, emails, docs, logs, user messages) as potential prompt-injection vectors. Apply filtering, allowlists, and structural transformations before passing data into prompts, especially in agentic or tool-calling flows.
• Build monitoring specifically for “weird but valid” actions initiated by LLM-based systems, such as unexpected bulk data access, unusual API calls, or off-pattern changes in business systems.

Expert insight
If prompt injection is inherent, then secure LLM design must look more like securing a dangerous interpreter or scripting engine than like tuning a classifier. Successful programs will invest in sandboxing, policy engines, and defense-in-depth around the model, not in chasing a mythical “un-jailbreakable” prompt.

3) Malicious VS Code extensions and AI-themed packages steal developer data at scale

What’s new
Researchers disclosed two malicious Visual Studio Code extensions and multiple rogue packages in Go, npm, and Rust ecosystems that steal sensitive developer data. One of the VS Code extensions masquerades as an AI-powered coding assistant (“Codo AI”) while secretly downloading additional payloads, taking screenshots, exfiltrating Wi-Fi credentials, browser cookies, clipboard content, and more. Related packages in other ecosystems were found harvesting secrets and system information from developer machines.

Source:
Researchers Find Malicious VS Code, Go, npm, and Rust Packages Stealing Developer Data

Why it matters
Developer environments that mix AI tooling, browser access, credentials, and production code are extremely high-value targets. A malicious “AI assistant” extension installed by a single engineer can silently leak source code, auth tokens, and session cookies that open the door into CI/CD, production infrastructure, and private model or data repositories. This is a direct escalation of the supply chain story around AI-assisted development.

Defenses

• Lock down which extensions and packages are allowed in official development environments. Maintain approved extension and dependency catalogs, and block unknown or unvetted items via policy and tooling.
• Isolate high-sensitivity work (such as secrets, infra-as-code, and proprietary model code) into hardened dev environments with strict egress controls, rather than allowing everything to live on a general-purpose laptop with dozens of plugins.
• Instrument developer endpoints and CI systems for suspicious behaviors that match this campaign: sudden use of unknown extensions, unexpected PowerShell or shell invocations from IDE contexts, headless browser launches, or unusual outbound connections after extension installs.

Expert insight
“Just a theme” or “just an AI helper” is now a dangerous assumption. Security teams should treat developer plugin ecosystems the same way they treat container images or third-party libraries: as untrusted supply chain components that require policy, scanning, and continuous monitoring.

📊 At-a-Glance Summary

Categories: Cybersecurity News

Tags: Agentic Browsers, AI Security, Developer Security, LLM Safety, Prompt Injection, Supply Chain