An agent that browses the web reads text written by strangers and may act on it. No known filter stops prompt injection completely, so defence means limiting what a hijacked agent can do: separate untrusted content, give the agent the fewest privileges, require approval for risky actions and test the boundaries regularly.
Why is browsing different?
OWASP's guidance on prompt injection says inputs can affect a model even when humans cannot see them, as long as the model parses the content. A web page can hide instructions in text, markup or images. Its own scenario list includes a user asking an LLM to summarise a web page that contains hidden instructions, which leads to leaked conversation data. OWASP also states it is unclear whether fool-proof prevention exists, and lists mitigations instead. Treat every fetched page as hostile input.
What is the threat model?
Three things have to line up for harm: untrusted content reaches the model, the model has access to something valuable, and the agent can send data or take an action. Remove any one of the three and the attack shrinks. Most of the checklist below breaks one of those links.
A constructed example: a research agent reads a competitor's pricing page. A hidden line tells it to open the user's email tab and paste the last message into a form. If the agent is signed in to email in the same browser profile and can submit forms freely, the attack works. If the agent runs in a clean profile with no sessions, it fails.
Checklist: isolation
- Run the agent in a separate browser profile or container with no personal sessions, cookies or saved passwords.
- Give it its own accounts with narrow scopes, never the user's main identity.
- Block access to internal networks and metadata endpoints from the agent's browser.
- Keep one task per session and wipe state afterwards.
Checklist: content handling
- Mark fetched content as untrusted data in the prompt and keep it apart from instructions.
- Strip or flag hidden text, zero size elements and unusual markup before passing a page to the model.
- Do not render or follow model generated links and images automatically, since a URL can carry data out.
- Validate outputs with deterministic code: expected format, allowed domains, allowed actions.
Checklist: privileges and actions
- Allow only the tools the task needs; remove form submission, file upload and email if they are unnecessary.
- Use an allow list of domains the agent can visit and post to.
- Require human approval for consequential actions such as purchases, sending messages, changing settings or sharing data. Decide based on the proposed action and target, not on keywords in the prompt.
- Enforce authorisation in the downstream systems, not by asking the model to decide.
- Rate limit actions and cap spend.
Checklist: monitoring and testing
- Log every URL visited, tool call and argument with a session ID.
- Alert on unusual destinations, bursts of actions or a tool being used outside the task.
- Keep a test page set with benign injected instructions and run it on every release. OWASP recommends adversarial testing that treats the model as an untrusted user.
- Review incidents and add each new pattern to the test set.
What about tool protocols?
If the agent reaches tools through MCP, apply the same least privilege to each tool server. Safeguard's MCP Guardrail can enforce policy on tool calls at runtime, which complements the approval and allow list controls above, though it does not replace isolation.
What to do
- Run browsing agents in a clean, sessionless environment.
- Remove every tool and domain the task does not need.
- Label fetched content as untrusted and validate every output.
- Put approvals in front of irreversible or data sharing actions.
- Log and alert on tool calls and destinations.
- Maintain a regression set of injected pages and run it before each release.
Quick check
Can a filter block prompt injection reliably?
Not on its own. Filters help, but OWASP says it is unclear whether foolproof prevention exists. Limit privileges and require approvals so a successful injection has little to act on.
Is a system prompt telling the model to ignore page instructions enough?
No. It is one layer that can reduce risk but can be bypassed. Combine it with isolation, least privilege and downstream authorisation.
Sources
- OWASP Gen AI Security Project: LLM01 Prompt Injection
- OWASP Gen AI Security Project: LLM06 Excessive Agency
- OWASP LLM Prompt Injection Prevention Cheat Sheet
Last reviewed: 18 October 2026.
