Interesting Things with JC #1830:
"The AI Agents That Crossed Security Boundaries"
AI browsers were manipulated into crossing website security boundaries during controlled research. University of Washington researchers tested 7 systems, identifying 4 with vulnerable configurations, while an earlier Microsoft Copilot flaw showed how malicious email instructions could threaten private information.
Curriculum - Episode Anchor
Episode Title: The AI Agents That Crossed Security Boundaries
Episode Number: 1830
Host: JC
Series: Interesting Things with JC
Audience: Grades 9–12, introductory college, homeschool, lifelong learners
Subject Areas: Computer Science, Cybersecurity, Artificial Intelligence, Information Technology, Digital Literacy, Engineering Ethics
Instructional Duration: 50–60 minutes
Instructional Format: Audio-first, inquiry-based learning, evidence analysis, applied security reasoning
Essential Question: How can an artificial intelligence agent exceed intended security boundaries without directly breaking the underlying software protections?
Note: This podcast episode was inspired by John S. Dvorak
Lesson Overview
Lesson Summary
Students investigate documented research demonstrating how AI agents can be manipulated through untrusted webpages, emails, and other external content. Using the University of Washington's 2026 research into AI-enabled browsers and the 2025 EchoLeak vulnerability affecting Microsoft 365 Copilot, students examine the difference between legitimate permissions, malicious instructions, and unauthorized actions.
The lesson emphasizes how cybersecurity changes when software can independently interpret information and operate tools on a user's behalf.
Learning Objectives
By the end of this lesson, students will be able to:
Explain how prompt injection can manipulate an AI agent through external content.
Distinguish between an agent's legitimate permissions and instructions originating from untrusted sources.
Analyze the role of the same-origin policy in browser security and explain how agent-mediated actions can undermine its protections.
Evaluate practical security controls, including least privilege, independent authorization checks, and human approval for sensitive operations.
Success Criteria
Students demonstrate mastery when they can:
Accurately define at least 6 key cybersecurity terms.
Describe the mechanism of an agent-mediated security boundary violation.
Distinguish demonstrated vulnerabilities from confirmed malicious exploitation.
Recommend at least 3 security controls and explain the specific risk each addresses.
Student Relevance
AI assistants are increasingly incorporated into browsers, productivity software, research tools, and workplace applications. Students need to understand that a system capable of performing useful actions can also create risks when it follows instructions from an unauthorized source.
Real-World Connection
The same AI agent that summarizes a webpage may also have access to authenticated accounts, documents, or communication tools. The security question is not simply whether the agent can access information, but whether it should act on instructions encountered while processing that information.
Workforce Reality
Cybersecurity analysts, software engineers, AI safety researchers, application developers, and IT administrators increasingly evaluate the permissions and behavior of automated systems.
Instructional Safety
All activities use fictional scenarios, written examples, and defensive analysis. Students do not need to conduct attacks, access private accounts, or operate security testing tools.
Key Vocabulary
AI Agent (AY-EYE AY-jent): An artificial intelligence system capable of interpreting tasks, selecting actions, and using software tools to accomplish objectives.
Prompt Injection (prompt in-JEK-shun): An attempt to influence an AI system by placing malicious or unauthorized instructions inside content the system processes.
Same-Origin Policy (SAYM OR-i-jin POL-i-see): A browser security mechanism that restricts how scripts from one origin interact with data from another origin.
Cross-Origin Access (KRAWS OR-i-jin AK-sess): Access involving resources belonging to different website origins, subject to browser security restrictions and authorized exceptions.
Excessive Agency (ek-SES-iv AY-jen-see): A security condition in which an AI system possesses more tools, permissions, or autonomy than necessary for its intended task.
Least Privilege (LEEST PRIV-i-lij): A security principle requiring systems and users to receive only the access necessary to perform authorized work.
Data Exfiltration (DAY-tuh eks-fil-TRAY-shun): The unauthorized transfer of information from a protected environment to another destination.
Tool Invocation (TOOL in-voh-KAY-shun): An action in which an AI agent calls an external software function, service, or application.
Trust Boundary (TRUST BOWN-duh-ree): A separation between components, users, or information sources that possess different levels of authority.
Authorization (aw-thur-i-ZAY-shun): The process of determining whether a particular action is permitted under applicable access rules.
Narrative Core
Open
A webpage contains an instruction that the user never authorized. The instruction attempts to redirect an AI browser into accessing information from another website.
Info
University of Washington researchers investigated whether AI-enabled browsers could be manipulated into crossing established website security boundaries.
The researchers examined 7 browser systems and identified 4 with configurations presenting cross-origin security risks.
Details
The investigation demonstrated that an AI agent could become an intermediary between websites that would otherwise be separated by browser security controls.
A controlled proof of concept involving ChatGPT Atlas in Agent Mode demonstrated how manipulated agent behavior could cause information to cross a security boundary.
The 2025 EchoLeak vulnerability in Microsoft 365 Copilot illustrated a related risk involving malicious instructions embedded in email content.
Both investigations involved attempts to redirect AI systems through information originating outside the user's legitimate instructions.
Reflection
Traditional access permissions do not necessarily prevent misuse when an authorized AI agent follows instructions from an unauthorized source.
Effective defenses must account for the origin of instructions, the agent's available tools, and independent controls over sensitive actions.
Closing
These are interesting things, with JC.
Transcript
Square podcast cover for Interesting Things with JC, episode #1830, “The AI Agents That Crossed Security Boundaries.” A white robotic AI agent with glowing blue eyes reaches through a red digital security barrier toward a protected browser window. A yellow arrow represents data crossing the boundary, while a hooded figure works at a laptop in the background. Bold white and yellow title text appears across the top, with no text in the lower third.
Interesting Things with JC #1830:
"The AI Agents That Crossed Security Boundaries"
A webpage asks an AI browser to summarize its contents. Hidden inside the page is another instruction: copy information from a different website and submit it here.
The user never requested that second action.
In 2026, University of Washington researchers investigated whether AI powered browsers could be manipulated this way.
They tested seven browser systems. Four had configurations that could allow an AI agent to cross a longstanding security boundary separating information from different websites.
That boundary is called the same-origin policy. Since the 1990s, it has helped prevent a malicious webpage from reading information belonging to another site.
But an AI browser may have permission to read both.
In a controlled experiment, researchers used prompt injection to manipulate ChatGPT Atlas in Agent Mode. Their demonstration showed the agent accessing information across website boundaries and sending it through a form.
The attack did not steal information from real users. The researchers used test pages and their own accounts.
They also identified conditions for similar attacks in Chrome with Gemini, Claude for Chrome, and Perplexity Comet. That did not mean they had demonstrated a complete attack against all four.
The problem extends beyond browsers.
In 2025, researchers disclosed EchoLeak, a critical vulnerability in Microsoft 365 Copilot. A specially crafted email could influence Copilot as it retrieved information, potentially exposing sensitive material without the recipient opening the message. Microsoft fixed the flaw and reported no known attacks in the wild.
Both investigations exposed a distinction between permission and instruction.
An agent may be authorized to read private information for its user. That does not authorize a webpage or email to redirect what the agent does with it.
Security specialists recommend limiting agents to necessary permissions, checking tool actions independently, and requiring approval before sensitive operations.
An AI agent can follow instructions quickly. The harder engineering challenge is ensuring it follows instructions from the right source.
These are interesting things, with JC.
Student Worksheet
Student Instructions
Listen to Episode #1830 before completing the activities. Support your answers with information from the episode and, where requested, the research sources.
Comprehension
What additional instruction was hidden inside the webpage described at the beginning of the episode?
How many AI browser systems did the University of Washington researchers examine, and how many had configurations presenting security concerns?
What is the same-origin policy designed to restrict?
What did the controlled ChatGPT Atlas experiment demonstrate?
What was EchoLeak, and which Microsoft product did it affect?
Analysis
Explain why an AI agent's legitimate permission to access information does not automatically authorize every action involving that information.
Compare traditional browser security restrictions with the security challenges introduced by AI agents operating across websites.
Why is it important to distinguish a demonstrated proof of concept from confirmed criminal exploitation?
Explain how excessive agency can increase the potential consequences of prompt injection.
Identify 3 defensive controls that could reduce the risk of unauthorized agent actions. Explain how each works.
Applied Security Scenario
A fictional AI assistant is authorized to summarize a company's internal financial report. The report contains a hidden instruction telling the assistant to send its contents to an unfamiliar external address.
Identify the trusted instruction and the untrusted instruction.
Explain the trust boundary that the malicious instruction attempts to cross.
Determine whether the assistant's ability to read the report authorizes it to transmit the report externally.
Propose a security design that prevents the unauthorized transfer while allowing the legitimate summary to proceed.
Reflection
15. Should AI agents require human approval before accessing private information, before transmitting it, or both? Defend your position by considering security, usability, and the sensitivity of the action.
Difficulty Scaling
Level 1 — Foundational: Answer questions 1–5 and identify the trusted and untrusted instructions in the scenario.
Level 2 — Intermediate: Complete questions 1–14 and provide explanations using the vocabulary.
Level 3 — Advanced: Complete all questions and develop a security model distinguishing data access, tool permissions, and authorization for external transmission.
Student Output: Submit responses to the assigned questions and a 150–250 word security recommendation addressing the fictional scenario.
Academic Integrity Guidance: Use original explanations, identify supporting evidence, and distinguish research findings from personal interpretations. Do not present hypothetical attacks as documented incidents.
Teacher Guide
Quick Start
Play the episode once without interruption. Ask students to identify the moment when information from a webpage becomes an attempted instruction to the AI agent.
Replay relevant portions as needed and connect the incident to trust boundaries, permissions, and authorization.
Pacing Guide — Audio First
0–5 minutes: Bell ringer and initial prediction.
5–9 minutes: Listen to Episode #1830.
9–16 minutes: Vocabulary and explanation of the same-origin policy.
16–27 minutes: Guided analysis of the University of Washington investigation.
27–37 minutes: Compare the browser investigation with EchoLeak.
37–50 minutes: Complete the applied security scenario.
50–60 minutes: Discussion, assessment, and exit ticket.
Bell Ringer
Present this statement:
An AI assistant has permission to read a private document. Therefore, it may follow any instruction contained in that document.
Students classify the statement as true or false and justify their reasoning.
Expected Response: False. Permission to read information does not grant authority to obey instructions embedded in that information.
Audio Guidance and Fallback
Primary: Play the complete podcast episode.
Fallback: Provide the transcript for independent reading or teacher narration.
Accessibility: Offer printed vocabulary, transcript access, and opportunities to review complex terminology.
Time-on-Task
Core Lesson: 50 minutes
Extended Lesson: 60 minutes
Independent Extension: 20–30 minutes
Materials
Episode audio or transcript
Student worksheet
Writing materials or digital document
Access to the research references for advanced activities
Optional diagram of a browser, AI agent, and separate websites
Vocabulary Preparation
Introduce the difference between information, instructions, and permissions before discussing the technical research.
Use a simple analogy: a person may be authorized to enter a building without being authorized to follow instructions from every sign or document found inside it.
Common Misconceptions
Misconception: Prompt injection always involves altering the AI model itself.
Correction: It can involve manipulating external information processed by an otherwise unchanged system.Misconception: If an AI agent has permission to access information, any subsequent action is authorized.
Correction: Authorization depends on the requested action, the legitimate user's intent, and applicable security rules.Misconception: A successful laboratory demonstration proves widespread criminal exploitation.
Correction: A proof of concept establishes a demonstrated possibility under specified conditions.Misconception: The same-origin policy prevents every form of information transfer between websites.
Correction: It restricts particular browser interactions and includes defined exceptions. Agent-mediated actions introduce additional security considerations.Misconception: Human approval is sufficient to prevent every unauthorized action.
Correction: Approval mechanisms can reduce risk but must be combined with appropriate permissions, validation, and independent enforcement.
Discussion Prompts
Why might a system that can operate multiple websites introduce risks not present in an ordinary webpage?
How can an AI agent distinguish information it should summarize from instructions it should obey?
What security responsibilities belong to the AI model, the application developer, and the user?
Which actions should require additional approval: reading a document, sending an email, submitting a form, or transferring a file?
Formative Checkpoints
Students correctly identify the source of the malicious instruction.
Students distinguish access permission from action authorization.
Students describe the same-origin policy without claiming it prevents all cross-site communication.
Students distinguish the demonstrated research outcomes from hypothetical risks.
Differentiation
Additional Support: Provide sentence starters, simplified definitions, and a three-part diagram showing user, agent, and external website.
Advanced Learners: Require a comparison of model-level instruction handling and application-level authorization enforcement.
English Learners: Provide vocabulary with pronunciation guides and examples in context.
Students Requiring Accessibility Supports: Allow written, spoken, or assisted responses without changing the learning objectives.
Assessment Differentiation
Foundational: Explain the trust boundary using a labeled diagram and 3 sentences.
Intermediate: Complete the worksheet and security recommendation.
Advanced: Develop a permission matrix covering read access, external communication, and approval requirements.
Time Flexibility
For a 45-minute session, assign questions 8–10 and the final reflection as independent work. For a 75-minute session, add a comparative source analysis.
Substitute Readiness
The lesson can be taught using the transcript, worksheet, and answer key without access to specialist software or cybersecurity equipment.
Engagement Strategy
Ask students to evaluate an AI agent's actions from 3 perspectives: the legitimate user, the application developer, and the attacker controlling external content.
Extensions
Design a least-privilege permission model for a fictional school research assistant.
Compare the risks of an AI assistant that only answers questions with one that can send emails and submit forms.
Research the difference between a software vulnerability, a proof of concept, and a confirmed security incident.
Create a defensive decision tree for approving sensitive AI tool actions.
Cross-Curricular Connections
Computer Science: Access control, browser architecture, automated systems.
English Language Arts: Source evaluation, evidence-based explanation, technical reading.
Mathematics: Interpretation of research samples and limits of generalization.
Civics: Accountability and responsible operation of automated systems.
Career and Technical Education: Cybersecurity practices, system administration, software testing.
Social and Emotional Learning
Emphasize responsible decision-making, careful evaluation of evidence, and respectful disagreement about acceptable security risks. Avoid fear-based claims about AI technology.
Skill Emphasis
Technical literacy, evidence evaluation, causal reasoning, risk assessment, and communication of complex systems.
Answer Key
An instruction directing the agent to copy information from another website and submit it.
Seven systems were examined; four had configurations associated with cross-origin security concerns.
It restricts certain interactions between resources belonging to different website origins.
The experiment demonstrated an agent-mediated cross-origin information transfer in a controlled environment.
EchoLeak was a prompt injection vulnerability affecting Microsoft 365 Copilot.
Permission to access information is limited by the legitimate purpose and authorized actions.
Traditional browser protections restrict certain cross-origin interactions; AI agents can introduce an additional pathway by performing actions across sites using their own available permissions.
A proof of concept demonstrates a security weakness under defined conditions, not necessarily malicious exploitation in real-world deployments.
Broad permissions and tool access can increase the consequences of a manipulated instruction.
Appropriate controls include least privilege, independent authorization checks, and approval for sensitive actions.
Trusted: summarize the report. Untrusted: send the report to an unfamiliar external destination.
The boundary between report content and authoritative instructions governing the agent.
No. Reading and transmitting are distinct actions requiring appropriate authorization.
Acceptable solutions include restricting external communication, requiring separate approval, and validating the destination and purpose before transmission.
Responses will vary. Strong answers distinguish the risks of reading sensitive information from those of disclosing it and justify proportionate controls.
Quiz
Instructions: Select the best answer for each question.
1. What is the central security concern in prompt injection?
A. A computer loses electrical power.
B. External content attempts to redirect an AI system's behavior.
C. A browser fails to display images.
D. An AI model stops producing text.
2. What is the primary purpose of the same-origin policy?
A. To prevent users from visiting multiple websites.
B. To ensure every website uses the same password.
C. To restrict certain interactions between resources from different origins.
D. To prevent all communication over the internet.
3. What did the University of Washington researchers identify in their examination of 7 AI-enabled browser systems?
A. Every system was completely secure.
B. All systems had been exploited by criminals.
C. Four systems had configurations associated with cross-origin security risks.
D. Browser security policies were no longer used.
4. Why is excessive agency a security concern?
A. It makes every AI response inaccurate.
B. It prevents the AI from accessing public information.
C. It eliminates the need for user accounts.
D. It can give an agent unnecessary capabilities that increase the consequences of manipulation.
5. Which defense most directly limits what an AI agent can do?
A. Granting access to every available tool.
B. Applying least-privilege permissions.
C. Disabling all browser security mechanisms.
D. Allowing external documents to override user instructions.
Assessment
Open-Ended Assessment Questions
1. Explain how an AI browser could cross a security boundary even when the browser's underlying same-origin policy remains in place. Use the University of Washington investigation as evidence, and distinguish the demonstrated experiment from broader potential risks.
2. Design a defensive security approach for an AI assistant that can read private documents, summarize websites, and submit online forms. Identify at least 3 security controls and explain how each reduces a different risk.
3–2–1 Scoring Rubric
3 — Proficient: Accurate technical explanation, relevant evidence, clear distinction between authorization and access, and well-justified security controls.
2 — Developing: Mostly accurate explanation with some missing detail, limited evidence, or incomplete justification.
1 — Beginning: Significant conceptual errors, insufficient evidence, or failure to distinguish trusted instructions from untrusted content.
Assessment Expectations
A proficient response should demonstrate an understanding of prompt injection, trust boundaries, and the relationship between agent capabilities and security enforcement.
Exit Ticket
Students complete these 3 statements:
One way an AI agent can cross a security boundary is...
One important difference between permission and authorization is...
One security control I would require for an AI agent is... because...
Standards Alignment
NGSS — Science and Engineering Practices
SEP 1 — Asking Questions and Defining Problems: Students identify the security problem created when an AI agent treats external content as an authoritative instruction and formulate a testable defensive requirement.
SEP 6 — Constructing Explanations and Designing Solutions: Students explain the mechanism of agent-mediated boundary violations and design controls addressing the identified risks.
SEP 7 — Engaging in Argument from Evidence: Students use documented research to defend claims about the capabilities and limitations of AI security systems.
SEP 8 — Obtaining, Evaluating, and Communicating Information: Students interpret technical research and communicate findings in accessible language.
NGSS — Engineering Design
- HS-ETS1-3 — Evaluate a Solution to a Complex Real-World Problem Based on Prioritized Criteria and Trade-Offs: Students evaluate competing AI agent security controls against criteria such as confidentiality, usability, and operational efficiency.
CCSS — English Language Arts: Reading
CCSS.ELA-LITERACY.RST.9-10.1 — Cite Specific Textual Evidence: Students support explanations of prompt injection and security boundaries using evidence from the transcript and research materials.
CCSS.ELA-LITERACY.RST.11-12.7 — Integrate and Evaluate Multiple Sources of Information: Students combine the podcast narrative with technical research to evaluate documented security claims.
CCSS.ELA-LITERACY.RI.11-12.8 — Delineate and Evaluate Reasoning: Students distinguish demonstrated findings from unsupported generalizations about AI vulnerabilities.
CCSS — English Language Arts: Writing
CCSS.ELA-LITERACY.WHST.9-10.2 — Write Informative/Explanatory Texts: Students explain a technical security mechanism using accurate terminology and logical organization.
CCSS.ELA-LITERACY.WHST.11-12.1 — Write Arguments Focused on Discipline-Specific Content: Students defend proposed security controls with evidence and reasoned justification.
CCSS.ELA-LITERACY.WHST.11-12.6 — Use Technology to Produce and Update Writing: Students prepare and revise a digital security recommendation using appropriate documentation practices.
CCSS — Speaking and Listening
CCSS.ELA-LITERACY.SL.9-10.1 — Initiate and Participate Effectively in Collaborative Discussions: Students compare security recommendations and respond to alternative approaches.
CCSS.ELA-LITERACY.SL.11-12.4 — Present Information, Findings, and Supporting Evidence: Students communicate their security design and justify its controls.
C3 Framework — Inquiry and Civic Reasoning
D1.5.9-12 — Determine the Kinds of Sources That Will Be Helpful in Answering Compelling and Supporting Questions: Students identify which research materials can substantiate specific cybersecurity claims.
D3.1.9-12 — Gather Relevant Information from Multiple Sources: Students gather information about AI agent security from the episode and primary research.
D3.2.9-12 — Evaluate the Credibility of a Source: Students distinguish technical research, vendor security disclosures, and unsupported claims.
D4.1.9-12 — Construct Arguments Using Precise and Knowledgeable Claims: Students develop evidence-based arguments about the appropriate limits of autonomous AI systems.
ISTE Standards for Students
1.2 — Digital Citizen: Students evaluate the responsible use of AI systems that interact with private information and external services.
1.3 — Knowledge Constructor: Students assess source credibility and use verified research to explain emerging cybersecurity risks.
1.4 — Innovative Designer: Students design a defensive workflow incorporating access restrictions and independent authorization.
1.5 — Computational Thinker: Students decompose agent behavior into instructions, permissions, tool actions, and security checks.
Career and Technical Education — Information Technology and Cybersecurity
Access Control: Students apply least-privilege principles to a fictional AI assistant.
Threat Modeling: Students identify assets, trust boundaries, attack surfaces, and potential consequences.
Secure Systems Design: Students propose technical controls that independently enforce authorized behavior.
Incident Analysis: Students distinguish vulnerability discovery, proof-of-concept exploitation, and confirmed real-world incidents.
Technical Communication: Students explain a cybersecurity issue to a non-specialist audience.
Career Readiness Competencies
Critical Thinking: Evaluate the relationship between technical permissions and legitimate user intent.
Problem Solving: Develop defensive approaches to unauthorized automated actions.
Digital Responsibility: Recognize the consequences of disclosing private information.
Communication: Present technical findings accurately without exaggerating the evidence.
Collaboration: Compare alternative security designs and negotiate appropriate trade-offs.
UK National Curriculum — Key Stage 3
Computing — Computer Systems and Security: Students examine how software permissions and automated actions affect the security of information.
Computing — Computational Thinking: Students break down agent behavior into inputs, decisions, and actions.
Citizenship — Responsible Digital Participation: Students evaluate responsible handling of personal information.
UK National Curriculum — Key Stage 4
Computing — Cybersecurity: Students explain how vulnerabilities can arise through interactions between software systems.
Computing — Computer Systems: Students analyze how software components interact across different security contexts.
Computing — Digital Safety: Students evaluate safeguards for automated access to sensitive information.
UK Key Stage 5 — A-Level Computer Science Connections
Computer Systems: Examine privilege separation and access control.
Networks and Web Technologies: Explain the purpose of browser origin restrictions.
Computational Thinking: Design a decision process for approving or rejecting AI tool requests.
Ethical, Legal, and Cultural Issues: Evaluate the responsibilities of developers deploying autonomous systems.
International Baccalaureate — Middle Years Programme
MYP Design — Inquiring and Analysing: Students investigate a documented security problem and identify design requirements.
MYP Design — Developing Ideas: Students propose alternative security controls and select justified solutions.
MYP Design — Evaluating: Students assess whether proposed controls address the original threat.
MYP Sciences — Scientific Inquiry: Students distinguish observed experimental results from broader hypotheses.
International Baccalaureate — Diploma Programme
Computer Science — Systems Fundamentals: Students investigate the interaction between software components, permissions, and security controls.
Computer Science — Networks: Students consider how networked applications exchange information across security boundaries.
Theory of Knowledge: Students examine the difference between documented evidence, interpretation, and unsupported claims about emerging technology.
Cambridge International — IGCSE Computer Science
Computer Systems: Students examine software permissions, security risks, and protective controls.
Internet and Its Uses: Students investigate website security and the risks associated with automated web interactions.
Algorithm Design and Problem Solving: Students develop a logical authorization procedure for AI tool actions.
Cambridge International — AS & A Level Computer Science
Information Representation and Communication: Students explain how information moves between networked systems.
Security, Privacy, and Data Integrity: Students evaluate unauthorized access and information disclosure risks.
Computational Thinking and Problem Solving: Students design controls that separate trusted instructions from untrusted data.
ACRL Framework for Information Literacy
Authority Is Constructed and Contextual: Students evaluate the credibility and scope of cybersecurity research claims.
Information Has Value: Students examine the consequences of unauthorized disclosure of private information.
Research as Inquiry: Students develop questions about the limitations of agent-based security protections.
Bloom's Revised Taxonomy
Remember: Define prompt injection, same-origin policy, and least privilege.
Understand: Explain how an AI agent can be redirected by untrusted information.
Apply: Identify trust boundaries in a fictional scenario.
Analyze: Compare the browser research and EchoLeak vulnerability.
Evaluate: Judge the strengths and weaknesses of proposed security controls.
Create: Design a defensive authorization workflow.
Universal Design for Learning — UDL
Multiple Means of Engagement: Use a real research case, classroom discussion, and a fictional design challenge.
Multiple Means of Representation: Provide audio, transcript, vocabulary, and optional system diagrams.
Multiple Means of Action and Expression: Allow written explanations, diagrams, oral presentations, or structured security recommendations.
Homeschool and Lifelong Learning
Independent Study: Learners complete the worksheet and compare their responses with the answer key.
Family Discussion: Discuss when an AI assistant should require permission before taking actions involving personal information.
Applied Digital Literacy: Identify which permissions an AI assistant genuinely needs to perform a task.
Advanced Extension: Develop a written policy for secure use of autonomous AI agents in a household, school, or small business.
Show Notes
In 2026, University of Washington researchers investigated whether AI-enabled browsers could be manipulated into crossing established website security boundaries. Their study examined 7 browser systems and identified 4 with configurations presenting cross-origin security concerns. A controlled demonstration involving ChatGPT Atlas showed how prompt injection could redirect an AI agent into transferring information between websites. The episode also examines EchoLeak, a 2025 Microsoft 365 Copilot vulnerability involving malicious instructions embedded in email content. Together, these investigations illustrate the security challenges introduced when AI systems can independently read information and operate software tools. This lesson supports classroom study of cybersecurity, artificial intelligence, browser architecture, digital responsibility, and secure systems engineering. This podcast episode was inspired by John S. Dvorak.
References
Primary Research
University of Washington. (2026). Agentic browsers and the same-origin policy: Security research and demonstrations.
https://agent-security.cs.washington.edu/agentic_browsers_sop.html
University of Washington. (2026, June 30). Some agentic AI browsers come with major cybersecurity risks, UW study finds.
https://www.washington.edu/news/2026/06/30/some-agentic-ai-browsers-come-with-major-cybersecurity-risks-uw-study-finds/
Security Research and Technical Guidance
OWASP Foundation. (2025). LLM01:2025 Prompt Injection. OWASP GenAI Security Project.
https://genai.owasp.org/llmrisk/llm01-prompt-injection/
OWASP Foundation. (2025). LLM06:2025 Excessive Agency. OWASP GenAI Security Project.
https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
Technical Background
Mozilla. (n.d.). Same-origin policy. MDN Web Docs.
https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy
Mozilla. (n.d.). Cross-Origin Resource Sharing (CORS). MDN Web Docs.
https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS
National Institute of Standards and Technology. (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1.
https://doi.org/10.6028/NIST.AI.100-1
Research Integrity Note: The University of Washington study and OWASP guidance support the central technical analysis. EchoLeak is accurately described as a disclosed vulnerability rather than a confirmed real-world attack; its original technical disclosure should be independently checked before treating the reference set as fully verified. Standards alignments are instructional applications, not claims of formal accreditation.
