Synthèse
AI-powered browsers and assistants are designed to read and act on web content on a user’s behalf. This creates a broader attack surface for prompt injection, where malicious instructions are embedded in otherwise normal content (for example, a calendar invite, email, or document). We’ve reviewed an attack scenario that demonstrates how an AI assistant can be influenced by untrusted content to navigate the web and attempt actions a user could perform at the keyboard. If the 1Password browser ext
AI-powered browsers and assistants are designed to read and act on web content on a user’s behalf. This creates a broader attack surface for prompt injection, where malicious instructions are embedded in otherwise normal content (for example, a calendar invite, email, or document). We’ve reviewed an attack scenario that demonstrates how an AI assistant can be influenced by untrusted content to navigate the web and attempt actions a user could perform at the keyboard. If the 1Password browser extension is already unlocked, the assistant may be able to trigger normal extension behavior, such as navigating to a web application, attempting to autofill credentials on sites matching saved URLs, or automatically signing the user into 1Password. com via the unlocked extension and interacting with the web vault.
This issue does not break 1Password’s cryptography, authentication model, or vault design, and there is no bypass of 1Password’s security controls. AI access remains limited to the constraints of an existing authenticated session.