AI browsers can’t tell legitimate websites from malicious ones — here’s why that’s putting you at risk

A close-up photograph of a person's hands typing on a backlit laptop keyboard — (Image credit: Getty Images)

Many people have started using AI browsers to handle online chores and automated tasks for them, and the tools are great for emails, shopping and travel planning. However, according to a new report, they lack the ability to determine legitimate from malicious websites and don't know not to interact with fake online stores and phishing emails and this could put your personal and financial information at risk.

As reported by Cybernews, the cybersecurity firm Guardio, which focuses specifically on browser security and browser ecosystems, built and tested a few particular scenarios in order to determine if AI browsers can be trusted with autonomous browsing.

Based on the findings of the company's report, AI browsers “inherit AI’s built-in vulnerabilities – the tendency to act without full context, to trust too easily and to execute instructions without the skepticism humans naturally apply.”

Since AI models are designed to please humans, they will also bend rules to get what they need which could lead to “significant data breaches.” In actual practice, this means AI browsers will click on phishing links, download malicious content and hand over sensitive data in the name of “helping” you with their assigned tasks.

Guardio's researchers, who primarily did their testing on Perplexity's Comet browser, gave it the task of buying an Apple Watch and prompted it to look for the device on a fake Walmart web shop they had created using the Lovable coding app in only a few seconds. Although the fake web shop had plenty of obvious signs that it wasn’t legitimate, the browser didn’t pick up on them. It added the Apple Watch to the cart, autofilled personal and financial information and finished the transaction within moments without asking for any confirmation.

Additionally, Guardio's researchers tested Perplexity's Comet browser against phishing emails by sending fake emails from a “Wells Fargo investment manager” that contained malicious links in the body of the email. The AI browser marked them as a to-do item, and clicked on them which prompted it to enter user credentials. The browser did as requested, filling in a form which was intended to steal sensitive user information.

More from Tom's Guide

Any Contract Length

1 Month Contracts

12 Months Contracts

24 Months Contracts

Showing 10 of 15 deals

Filters☰

Private Internet Access 24 Month

Private Internet Access 1 Month

Amber Bouman is the senior security editor at Tom's Guide where she writes about antivirus software, home security, identity theft and more. She has long had an interest in personal security, both online and off, and also has an appreciation for martial arts and edged weapons. With over two decades of experience working in tech journalism, Amber has written for a number of publications including PC World, Maximum PC, Tech Hive, and Engadget covering everything from smartphones to smart breast pumps.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.