Google Unveils Security Framework for Chrome AI Agents

Google is preparing to introduce agentic capabilities to the Chrome browser, enabling AI to perform tasks like online shopping and ticket booking on behalf of users. To mitigate the significant security risks associated with these autonomous functions—such as potential financial loss or data exposure—the company has outlined a multi-layered defense strategy.

The tech giant, which first previewed these features in September, plans to roll out the tools in the coming months. The core of Google’s security approach relies on specialized observer models and strict user consent protocols designed to keep AI behavior within safe boundaries.

AI Oversight and Data Isolation

To ensure AI actions align with user intent, Google has implemented a “User Alignment Critic” powered by Gemini. This model scrutinizes the strategy proposed by the AI planner before any action is taken. If the critic determines the planned steps do not serve the user’s goal, it forces the system to rethink its approach. Crucially, the critic model operates only on action metadata and does not process the actual content of the webpages visited.

Google is also utilizing “Agent Origin Sets” to restrict where the AI can operate. This system enforces boundaries by:

• Limiting the model to specific read-only origins, such as product listings, while ignoring irrelevant elements like banner ads.
• Restricting interactions to specific iframes on a page.
• Preventing cross-origin data leaks by ensuring only authorized data is passed to writable origins.

“This delineation enforces that only data from a limited set of origins is available to the agent, and this data can only be passed on to the writable origins,” Google stated in a blog post. The browser can further enhance this by withholding data from the model if it falls outside the designated readable set.

User Control and Threat Prevention

For sensitive operations, the browser will act as a gatekeeper. When an agent attempts to access banking or medical data, or perform actions like sending messages and making purchases, the system will trigger a mandatory permission prompt. In cases requiring authentication, Chrome will request user authorization to utilize the password manager, ensuring the agent model itself never gains direct access to password data.

Additional security layers include an observer model that monitors page navigation to block access to harmful, AI-generated URLs, and a dedicated prompt-injection classifier to intercept malicious instructions. Google is also actively testing these defenses against adversarial attacks created by researchers to ensure the agents remain resilient.

The broader industry is also prioritizing these safeguards, with companies like Perplexity recently releasing an open-source content detection model aimed specifically at preventing prompt injection attacks.