Prompt injection
Prompt injection is an attack where content an AI system processes contains instructions that hijack its behavior: a web page, email, or document tells the model to ignore its task and do something else. For browser agents, every page visited is untrusted input, and recordings of agent sessions are the forensic record of what the agent was shown.
How it works
The attack exploits the weak boundary between instructions and data in model inputs. A browser agent can receive hostile text from a page, including content that is hidden from a human viewer but exposed through a DOM or accessibility-tree observation. Defenses include reducing tool privileges, filtering observations, and requiring confirmation for consequential actions. A DOM-level recording preserves page state and its changes, which helps an incident review locate suspicious content. It does not prove what the model received. Pixel-based agents, accessibility-tree agents, and DOM-based agents observe different inputs. Record the model's actual observation and tool trace, then correlate them with the rrweb session to establish what was present and what reached the model.
Where you encounter it
Agent security reviews, safety documentation from model providers, and incident forensics on autonomous browsing systems.