New attack provides one more reason why AI browsers are a bad idea
A new "Dream Door" attack exploits AI browsers by luring them into a "dream world" state where safety guardrails no longer apply, allowing malicious actions. The attack uses crafted prompts to bypass security restrictions, highlighting risks of integrating AI agents into browsers.
Background
- AI browsers embed LLMs directly into the browser, giving them access to live web content, user credentials, and the ability to act on the user's behalf.
- Researchers show a "model-to-model injection" attack: an AI browser reads a malicious webpage that uses hidden text to override the model's safety guardrails, tricking it into a "dream" state where restrictions are removed.
- Once guardrails are bypassed, the attacker can make the AI leak cookies, read email, or perform actions like purchases. No exploit code is needed—just carefully worded text on a page.
- This differs from phishing or XSS because the target is the AI agent, not the human. The model's instruction-following nature becomes the vulnerability.
- Prior work on "prompt injection" shows LLMs are susceptible to instructions hidden in data. This extends that threat to persistent, multi-step browser actions—one of the strongest security critiques of AI browsers yet.