The most privileged process on the laptop now takes instructions from whatever it reads.
Agentic browsers expose page content, the tab graph, history, and authenticated connectors to a model so it can open tabs, click, fill forms, and chain workflows on the user's behalf. For thirty years the browser was a viewport. It's now a runtime — and it holds live sessions to every system your employees are logged into.
Every browser control in the enterprise is oriented outbound.
That was defensible when the browser only answered questions. Now that it acts, what comes back into the page is an instruction stream executing inside an authenticated session, and it's the channel with no coverage at all.
Data going out
AI use on corporate devices rose from 15% to 45% in a year, two thirds of it on non-corporate accounts. Source code was the most frequently submitted data type across 858,440 DLP events involving generative AI uploads.
Instructions coming in
Of seven agentic browsers tested, four created conditions for an attacker to bypass the same-origin policy — the 1995-era boundary that stops one site reading another's data. The researchers demonstrated a working proof of concept.
DLP and CASB inspect artifacts
They assume data leaves as a file uploaded, an attachment sent, a document synced. A paste into a prompt box creates none of those. The transport often isn't inspectable either — QUIC and HTTP/3 can bypass proxy inspection outright, and certificate pinning removes decryption as an option. When inspection does work, the resolution is wrong: a connection maps to a provider name, not to which model, which tool calls, or what was in the prompt.
Enterprise browsers govern containers
Copy-paste restrictions, download control, watermarking, session isolation — real controls, but binary. They block the safe paste and the unsafe paste identically, so users route around them. And a control that is a browser has to win the browser, against AI-native forks arriving monthly. Its scope also stops at the browser, leaving coding agents, CLI sessions, and MCP connections on a second policy plane that drifts.
Inside the page, before any transport is negotiated.
The extension observes the interaction where the prompt exists as plaintext, and evaluates it through the local Operant Gateway that Endpoint Protector already runs on the device. It's an extension of Endpoint Protector, which is required for it to function.
QUIC, HTTP/3, pinning, split tunnels, VPN off in a hotel — none of it affects enforcement, because the decision happens before the request is constructed. No proxy to bypass, no backhaul.
The classification pipeline and audit trail governing a browser prompt are the same ones governing a Claude Code session, a CLI agent loop, and an MCP tool call. One PII definition. One record.
Prompts are checked before submission; responses are checked before they render. That second half is the control that matters once the browser acts on what it reads.
Every checked action resolves to a state.
Proceeds normally. The overwhelming majority, and invisible.
Restricted content is replaced and the sanitized version is submitted instead of the original. The question still gets answered; the account number never reaches the model.
The action stops, with an explanation in the page, and the prompt stays available for editing. Attachments and downloads needing sanitization are blocked rather than rewritten — silently altering a file the user never sees altered is worse than an honest stop.
Evaluation in progress.
Chrome, Edge, Brave, and Firefox cover most managed fleets — and the AI-native browsers arriving now are, almost without exception, Chromium forks
ChatGPT, Claude, Gemini, Microsoft Copilot, and more, on the extension platform rather than per-vendor integrations
Microsoft Intune, Jamf, and similar, across Windows, macOS, and Linux
Fail closed, stated up front