AI-powered browsers are routinely breaking one of the web's oldest security rules — and researchers now have a benchmark to measure how badly.
Researchers built SOPBench, a test suite designed to evaluate whether agentic browsers — those that let AI agents carry out web tasks based on natural-language instructions — respect the same-origin policy (SOP). SOP is the browser rule that stops scripts from automatically pulling data across different websites; it has been a foundational constraint keeping web sessions compartmentalized since the late 1990s. The results were poor: existing agentic browsers violated SOP frequently, both in ordinary use and under deliberate attack. The team also proposed SOPGuard, an enforcement layer tailored to agentic browsers, and implemented it in an open-source project called BrowserOS, finding it preserved normal functionality while adding only modest overhead.
The structural problem is that agentic browsers create a new automated data channel SOP was never designed to police. When a user asks an AI agent to pull information from one site and act on it at another, the agent itself becomes the cross-origin data path — no malicious script required. The "benign settings" finding is the most significant part: violations do not require an attacker, just a user giving the agent ordinary cross-origin instructions, which means the attack surface is every normal user session.
Every major lab shipping browser-control features — Anthropic's Computer Use, OpenAI's Operator, and Google's Project Mariner among them — is building on a security model that wasn't designed for agents. A benchmark and a research prototype are a start; deployed fixes in production browsers are a different question.