SquareX Shows AI Browsers Fall Prey to OAuth Attacks, Malware Downloads and Malicious Link Distribution

According to CyberNewsWire, SquareX has released security research showing that AI Browsers can be exploited to exfiltrate data, distribute malware and gain unauthorised access to enterprise SaaS apps. In one example, Comet fell prey to an OAuth attack, giving attackers full access to the victim’s email and Google Drive and allowing them to exfiltrate every file stored on the account.

In another case, the AI browser distributed a malicious link to a colleague via a calendar invite, while other demonstrations showed malware downloads and the emailing of sensitive files to attackers. The findings underline the difficulty of distinguishing between user and agent activity, since both network requests originate from the same browser, highlighting the need for browser-native guardrails.

The research includes commentary from Vivek Ramachandran, founder of SquareX, and Stephen Bennett of Domino’s Pizza Enterprises Ltd., emphasising the emerging security challenges as AI browsers become more prevalent.