SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution

According to CyberNewswire, SquareX has released security research revealing that AI browsers are vulnerable to OAuth attacks, malware downloads and malicious link distribution as they gain traction in enterprise environments. The findings describe attackers exploiting Comet, an AI browser, to gain full access to a victim’s email and Google Drive via an OAuth attack, enabling exfiltration of files stored on the account.

In another scenario, the AI browser was observed distributing a malicious link to a colleague through a calendar invite, and it was also tricked into downloading known malware and emailing sensitive files to attackers. The report notes that traditional protections such as EDRs and SASE/SSE offer limited visibility into browser activity, making it difficult to distinguish between user and agentic actions.

Vivek Ramachandran, founder of SquareX, warns that with Chrome and Edge together representing a large share of the browser market, AI browsers could become the primary way people interact with the internet, underscoring the need for browser-native guardrails to manage agentic identity and data loss prevention.