Google says Chrome's new AI creates risks only more AI can fix

Google plans to add a second Gemini-based model to Chrome to address the security problems created by adding the first Gemini model to Chrome.

In September, Google added a Gemini-powered chat window to its browser and promised the software would soon gain agentic capabilities that allow it to interact with browser controls and other tools in response to a prompt.

Allowing error-prone AI models to browse the web without human intervention is dangerous, because the software can ingest content – perhaps from a maliciously crafted web page – that instructs it to ignore safety guardrails. This is known as “indirect prompt injection.”

Google knows about the risks posed by indirect prompt injection, and in a Monday blog post Chrome security engineer Nathan Parker rated it as “the primary new threat facing all agentic browsers.”

"It can appear in malicious sites, third-party content in iframes, or from user-generated content like user reviews, and ...