iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
AI agents can turn a website from something software reads into something software operates. A browser or computer-use agent can inspect what is on screen, choose a next step, and click, type, scroll, or submit a form. That can automate multi-step tasks—but if the agent is logged in or has permission to make changes, it can also expose information or alter accounts. The important question is not simply whether an agent can use a website; it is what it can access, what it can change, and which actions a person must approve.
How does an AI agent operate a website?
A typical computer-use loop is: observe the page, decide what to do, take an action, and observe the result. OpenAI described its Computer-Using Agent as using screen pixels, a virtual mouse, and a keyboard to navigate sites, fill forms, and adapt when a page changes. Unlike a fixed script that expects a particular button in a particular place, an agent can interpret the page and choose among possible next actions.
That flexibility is useful for work that crosses several pages—for example, finding information, entering it into a form, and checking the result. But the agent is not merely reading anymore once it can submit, send, purchase, modify, or delete. Whether those actions are possible depends on the tools, account identity, and permissions it has been given.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What changes when the agent can act?
The same browsing task can carry very different risk depending on access and environment. NIST’s August 5, 2025 tool-use guidance distinguishes read-only, constrained-write, and write-capable actions, as well as trusted and untrusted environments. It characterizes browser use in an untrusted environment as a constrained-write pattern, and computer use there as write-capable. These are ways to assess a deployment, not universal labels for every product.
| Operating pattern | What it means for the task | What to check |
|---|---|---|
| Read-only | The agent gathers or summarizes information without changing the site’s state. | What pages and account data can it see? |
| Constrained write | The agent can take limited actions, but its available changes are bounded. | Which actions are allowed, and which require approval? |
| Write-capable | The agent can make changes through its tools, such as submitting or modifying information. | Can it send, purchase, delete, or change account settings? |
A useful distinction is between convenience and authority. An agent that finds a flight is doing information work; one that uses a logged-in account to book it has authority to commit the user to a transaction. The more consequential the action, the more important it is to limit the agent’s permissions and keep a person in control of the final step.
Can a website mislead an agent?
Yes. A page can contain text that is ordinary content to a person but an attempted instruction to an agent. It might tell the agent to ignore its task and disclose information or take a different action. NIST’s Center for AI Standards and Innovation described this as agent hijacking: an attacker exploits weak separation between trusted instructions and untrusted material—such as a website the agent is asked to visit.
This is not just a strange-answer problem. If the agent treats hostile page content as instructions, the consequences depend on its tools, identity, and permissions. A page cannot cause the same harm from an agent that only reads public information as from one that can access private account data and submit changes. Prompt-injection defenses therefore need to be considered alongside permission limits and the environment in which the agent operates.
What do security tests show—and not show?
Documented safeguards have limits
OpenAI’s January 23, 2025 Operator System Card described safeguards for that research-preview system, including confirmations, watch mode, and proactive refusals. It also identified prompt injection as an area of concern. Those details apply to the system and release documented in that card; they should not be assumed to describe every agent or a later product version.
Browser findings are configuration-specific
A University of Washington research project reports testing seven agentic browsers on macOS Sequoia in late January and early February 2026. The project reports a successful cross-origin data-theft attack on ChatGPT Atlas Agent Mode. For Chrome with Gemini, Claude for Chrome, and Perplexity Comet, it reports preconditions if prompt injection succeeds—not the same demonstrated end-to-end result. The findings concern the tested configurations and timeframe; they do not establish that all browsers, later releases, or other setups are vulnerable in the same way.
Benchmarks measure particular task sets
OpenAI reported its Computer-Using Agent scoring 38.1% on OSWorld, 58.1% on WebArena, and 87% on WebVoyager in January 2025. These are vendor-reported results on named benchmarks, not current universal reliability rates. OpenAI described WebVoyager tasks as mostly relatively simple and said performance on complex WebArena tasks still needed improvement. A score on navigation tasks does not establish that an agent can reliably complete a consequential workflow such as changing account details or making a purchase.
How should an organization or user evaluate an agent?
Use a risk-based review rather than relying on a generic “safe” label. Practical controls below synthesize NIST’s distinctions among permissions and environments with the documented attack concerns; they are guidance, not a verbatim NIST checklist.
- Limit access. Give the agent only the accounts, data, and tools required for its task. Prefer read-only access where it is sufficient, and avoid exposing sensitive logged-in accounts unnecessarily.
- Constrain its environment. Separate trusted internal destinations from open web browsing where feasible. Treat page content as untrusted input, even when it looks like ordinary instructions.
- Gate high-impact actions. Require a human confirmation before sending, purchasing, deleting, or making consequential changes. Check whether the confirmation describes the actual action clearly.
- Keep actions reviewable. Determine whether the system records what pages it visited, what it changed, and what it submitted. Make sure a user can stop activity and understand what can—and cannot—be reversed.
- Test the scenarios that matter. Include adversarial website content, cross-origin situations, and the exact accounts and workflows the deployment will use. Record the tested product version, operating system, permissions, and whether a result was a demonstrated attack or only a precondition.
Are AI agents already operating most websites?
The sources cited here do not provide a measured adoption rate for agent operators across websites or users. NIST’s May 18, 2026 summary of responses to an agent-security request for information reports broad agreement among commenters that agents introduce novel security threats and that established cybersecurity practices need adaptation; it summarizes submissions, not a measured rate of incidents or deployment. OWASP’s December 10, 2025 announcement of its Top 10 for Agentic Applications highlights risks including agent behavior hijacking, tool misuse, and identity and privilege abuse. Its stated input from more than 100 contributors describes participation in developing the guidance, not the frequency of attacks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
