Same-Origin Policy for Agentic Browsers

2026-06-11

AI Summary

This work addresses a critical security gap in existing agent browsers, where autonomous AI agents may circumvent the Same-Origin Policy (SOP), leading to cross-origin data leakage—a risk for which SOP’s efficacy remains underexplored. The study reveals, for the first time, that the agent browser itself can act as an automated conduit for cross-origin data flows. To mitigate this, the authors propose SOPGuard, the first mechanism designed specifically to enforce SOP in such environments, and introduce SOPBench, a benchmark for systematically evaluating SOP violations. SOPGuard integrates static and dynamic policy analysis and is implemented within an open-source BrowserOS platform. Experimental results demonstrate that SOPGuard effectively prevents SOP violations with only minimal runtime overhead while preserving functional usability, thereby substantially enhancing the security of agent browsers.

Abstract

Agentic browsers integrate autonomous AI agents into web browsers, enabling users to accomplish web tasks through natural-language instructions. The same-origin policy (SOP) is a fundamental browser security mechanism that prevents unauthorized automated cross-origin data flows induced by scripts. However, whether SOP remains effective in agentic browsers is an open question that has not been systematically studied. In this work, we bridge this gap. We first observe that an agentic browser can itself serve as an automated channel for cross-origin data flows, potentially leading to SOP violations. To investigate this phenomenon, we construct SOPBench, a benchmark for evaluating SOP violations in agentic browsers. Our evaluation shows that existing agentic browsers frequently violate SOP, both in benign settings and under attacks. To address this problem, we propose SOPGuard, an SOP enforcement mechanism tailored to agentic browsers. We implement SOPGuard in BrowserOS, an open-source agentic browser. Extensive evaluations demonstrate that SOPGuard effectively enforces SOP while preserving utility and incurring only a small runtime overhead. Our code and data are available at https://github.com/wxl-lxw/BrowserOS-SOPGuard.

Problem

• Same-Origin Policy
• Agentic Browsers
• Cross-Origin Data Flow
• Browser Security
• SOP Violation

Innovation

• agentic browsers
• same-origin policy
• SOPGuard
• cross-origin data flow
• browser security