16Prompt injectionBelow the top 20
Drive-by injection of browser agents
CapabilityAffordanceImpact domainCap-adjacent
Statement (NASA form)
Given that browser-using agents visit the open web with cookies and logged-in sessions, there is a possibility of a page the agent reads issuing instructions the user never saw resulting in a session that books, buys, or leaks because a website asked.
Likelihood
4Likely
Consequence
3Major
Urgency
4Expedite
The address bar is now a tool API.
Composite 16 = 4×3 + 4