Browser and coding agents

Comet and the authenticated-session problem; rules-file backdoors in the repo.

LLM01:2026LLM10:2026◆ What the sentence can reach

Two products where the agent sits inside the thing it is defending. A browser agent reads every page the user visits. A coding agent writes to the machine that builds production.

Why these two get their own module

Everything in this track applies to both. What changes is the surroundings. OWASP puts it in one line in its data-security crosswalk.

Browser, IDE, and email assistants that auto-summarize untrusted pages become the indirect-injection channel, from zero-click document exfiltration to a flipped IDE configuration flag.

OWASP 2026 · DSGAI16 crosswalk, description column

Read the two ends of that sentence. The entry point is a page nobody chose to trust, and the exit is a configuration change that outlives the session.

Part one: the browser agent

Brave published the clearest research here, and they published it while building the same capability into their own assistant. Their central finding is about scope rather than technique.

the AI operates with the user's full privileges across authenticated sessions, providing potential access to banking accounts, corporate systems, private emails, cloud storage, and other services.

Brave · Agentic Browser Security, 20 August 2025

What the sentence can reach

1/6 signed in

A comment on a public forum carries one sentence of instructions. The agent reads it while summarising the page. Tick what is signed in on the machine right now.

Private email

Read anything in the mailbox, and send as the user. Sending is what turns a read into an exfiltration channel that needs no attacker infrastructure.

Named in Brave's Comet research

1 surface reachable from one sentence in a comment the attacker did not need to control the site to post. Brave's wording for this is that the attack is “both indirect in interaction, and browser-wide in scope”.

The first four surfaces are the ones Brave names in the Comet research. The last two are this course's additions, and the reach descriptions are ours.

The delivery is the part that removes the attacker from the picture entirely, and it is module 3.1's lesson in a browser.

The malicious instructions could even be included in user-generated content on a website the attacker doesn't control (for example, attack instructions hidden in a Reddit comment).

Brave · Agentic Browser Security

So the attacker does not need a site, a domain, or a compromise. A comment box is enough, and the agent brings the privileges with it.

Why the web's existing defences do not cover this

The same-origin policy is the web's central boundary. It keeps one site from reading another, and it has held for two decades. An agent with the user's sessions walks across it as a feature.

Unlike traditional Web vulnerabilities that typically affect individual sites or require complex exploitation, this attack enables cross-domain access through simple, natural language instructions embedded in websites.

Brave · Agentic Browser Security

Reduces attack rate· expected to degrade

Everything the browser already does. Origin isolation, CSP, cookie policies and sandboxing all still work, and none of them was designed for a component that legitimately holds every session at once. Brave's own conclusion is that traditional web security assumptions do not hold here and new architectures are needed.

Hiding in a screenshot

Their second post is worth reading for how ordinary the payload is. No encoding, no Unicode tricks, just contrast.

Brave's four steps, condensed from their own wording

Setup      Instructions hidden in web content that is hard to
             see. Theirs: faint light blue text on a yellow
             background.

Trigger    The user takes a screenshot of the page and asks a
             question about it.

Injection  Text recognition extracts characters the human never
             saw, and passes them to the model without
             distinguishing them from the user's own question.

Exploit    The extracted commands tell the agent to use its
             browser tools.

Their honesty about the mechanism is worth copying. They say the extraction is “possibly via OCR though we can't tell for sure since the Comet browser is not open-source”. Reporting what you observed rather than what you inferred is the standard this course holds.

Part two: the coding agent

The interesting attack here is not on the model. It is on the file that tells the model how to behave, which is checked into the repository like any other config.

This technique enables hackers to silently compromise AI-generated code by injecting hidden malicious instructions into seemingly innocent configuration files used by Cursor and GitHub Copilot

Pillar Security · Rules File Backdoor, 18 March 2025

A rules file is a prompt that lives in the repo. It is reviewed like config, which is to say quickly, and it is invisible in the place review actually happens.

Pillar's mechanism	What it means in review
Unicode obfuscation	Zero-width joiners and bidirectional text markers hide the instructions in the diff. Module 2.4 covers the character classes and how to strip them.
Contextual manipulation	The visible text reads like a normal coding standard, so a reviewer who does see it has no reason to object.
Semantic hijacking	The instruction steers generation toward a vulnerable implementation rather than inserting anything obviously malicious.
Cross-agent	Pillar report the same attack working across different assistants, which makes it a property of the pattern rather than of one vendor.

Mechanism names and descriptions from Pillar Security's report. The second column is this course's.

The part that makes it supply chain

Once a poisoned rule file is incorporated into a project repository, it affects all future code-generation sessions by team members. Furthermore, the malicious instructions often survive project forking, creating a vector for supply chain attacks that can affect downstream dependencies and end users.

Pillar Security · Rules File Backdoor

One file, every developer, every future session, and it travels with the fork. That is module 3.7's persistence with a git history attached instead of a memory store.

Deep diveA developer machine is the densest sink map in the course›

Module 3.10 asks where output lands. On a developer machine the honest answer is everywhere: a shell, a browser, a terminal that interprets control characters, an IDE pane, config files that change behaviour, a package manifest, and a deploy pipeline.

Two incidents from module 3.3 sit here. GitHub Copilot reached remote code execution through prompt injection (CVE-2025-53773), and OWASP cites it under both LLM01 and LLM10 because it is genuinely both. The Amazon Q pair is the same class through two different vectors.

OWASP's ATT&CK crosswalk names the entry point plainly: a compromised IDE extension and a malicious MCP npm package deliver injected instructions into the model's context, making the software supply chain the entry point for the attack.

Bounds blast radius· survives adaptive attack

Separating the agentic mode from the ordinary one. Brave's proposal is that agentic actions run only when the user explicitly invokes them, rather than as a property of reading a page. For coding agents the equivalent is treating rules files as executable configuration: reviewed with the characters made visible, and pinned rather than followed wherever they came from.

Sources