Home

Podfeet Podcasts

Security Bits logo - a green padlock with the words Security Bits to the right and in tiny letters below ithat it says 10101010 indicating a digital lock

Security Bits β€” 18 December 2025

  • by Bart Busschots

    • Feedback & Followups

    Deep Dive β€” Google’s New Agentic AI Browser Security Framework

    There have been a lot of conversations around Agentic AI browsers on the NosillaCast recently, and the one thing they’ve all had in common is a resounding warning to be very cautious at the moment because we’re still in the wild west-like early days, where there are a lot of very dangerous bugs. One of the things I have been saying is that we need a fundamental change in the architecture to avoid the fundamental problem of having the prompt and the content of the web pages being interacted with going into the same LLM, making prompt injection almost inevitable.

    Google have just released details of their planned architecture to start addressing those problems in Chrome. Their approach is interesting and promising, so that this is not the end of the wild-west day, nor even the beginning of the end, it just might be the end of the beginning (as Churchill might have put it).

    Google’s architecture has the following key components:

    1. The so-called User Alignment Critic β€” a completely separate LLM that is never fed any content from the web, so it can’t be prompt-injected. It watches over the agent’s activities to ensure they remain aligned with the user’s best interests. This is AI watching AI, so it can’t ever be perfect, but having an isolated AI that can’t be prompt-injected is a very promising idea.
    2. So-called origin sets β€” this is basically the AI-version of the existing content origin model used to restrict JavaScript code from reaching outside of the website the user explicitly visited. This stops a rogue agent from accessing random sites as the user.
    3. Google will show the user exactly what the agent is doing through what amounts to a real-time activity log, and dangerous actions will require explicit confirmation to proceed.
    4. A third AI will check the content the agent is about to ingest as context for known kinds of prompt injection. Again, can’t ever be perfect, but like an anti-virus, it should weed out everything but the most novel and innovative techniques.

    Google are also putting their money where their mouth is by adding new categories to their bug bounty program to cover these new security controls.

    Links

    • A nice summary: https://www.bleepingcomputer.com/news/security/google-chrome-adds-new-security-layer-for-gemini-ai-agentic-browsing/
    • A good detailed explanation: https://cyberinsider.com/google-launches-new-security-architecture-for-ai-agents-in-chrome/

    Discussion β€” AI Agents in Meetings

    Allison suggested a free-form discussion based on this communiquΓ© received by a Nosillacastaway: Important Security Notice: Required Deactivation of Read AI β€” it.uw.edu/… (UW is the University of Washington in the US).

    Related insight from Bart: Maynooth University similarly do not allow third-party AI tools integrate into meetings, but they do allow the corporate version of Microsoft Copilot. Why? Because Microsoft offer guaranteed data boundaries and certify compliance with relevant legislation like GDPR. Organisations using the corporate version of Copilot can be sure their data does not leave their Office365 tenancy when it’s processed by Microsoft’s various Copilots.

    ❗ Action Alerts

    Worthy Warnings

    Notable News

    Interesting Insights

    Palate Cleansers

    blinking red green yellow dots on green background in the triangle shape of a tree

    blinking red yellow dots above candles in a menorah

    Legend

    When the textual description of a link is part of the link, it is the title of the page being linked to, when the text describing a link is not part of the link, it is a description written by Bart.

    Emoji Meaning
    🎧 A link to audio content, probably a podcast.
    ❗ A call to action.
    flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
    πŸ“Š A link to graphical content, probably a chart, graph, or diagram.
    🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” πŸ™‚
    πŸ’΅ A link to an article behind a paywall.
    πŸ“Œ A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
    🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.
    🎦 A link to video content.

    Leave a Reply

    Your email address will not be published. Required fields are marked *

    Scroll to top