Likelihood: MODERATE
Impact: HIGH
Treatment: MITIGATE
Confidence: Moderate
Likelihood is moderate: exploitation requires the attacker to serve a malicious web page to a user running an affected AI browser in agentic mode — a realistic but not ubiquitous condition given current enterprise AI browser adoption rates and the absence of confirmed in-the-wild exploitation. Impact is high because the attack targets credentials and authenticated sessions directly, meaning a single successful execution can yield lateral movement, data access, or account takeover across enterprise systems far beyond the browser itself.
Treatment rationale: The attack surface — AI browser agents operating in agentic mode with access to enterprise credentials — is controllable through immediate use restrictions, tooling controls, and vendor remediation pressure, making active mitigation both feasible and proportionate to the high potential impact.
Third-Party / Supply-Chain Risk
Material third-party and supply-chain exposure under NIST SP 800-161: organizations are dependent on six named AI browser vendors (OpenAI, Anthropic, Perplexity, Fellou, Genspark, Sigma) to remediate a structural design flaw in their products. Remediation is entirely outside the organization's direct control. Where these tools are deployed enterprise-wide via IT procurement or MDM, the organization's credential exposure scales with vendor adoption — a single unpatched agentic browser session accessing a corporate identity provider or SSO portal represents a shared-platform risk across all downstream systems that session can reach.
Loss Exposure (illustrative)
Magnitude: High — illustrative $500K–$5M per incident for an enterprise with broad AI browser deployment, reflecting credential-driven lateral movement, incident response, identity remediation, and potential regulatory exposure
Frequency: Illustrative: for an organization with active agentic AI browser deployment and no compensating controls, one plausible exploitation event per 1–3 years given current attacker interest in AI tooling and the low technical bar for serving malicious page content
Annualized: Illustrative ALE: approximately $200K–$2M annualized, derived from mid-range magnitude ($500K–$5M) discounted by moderate likelihood of occurrence in a given year for an exposed organization
Basis: Magnitude driven by: credential theft enabling lateral movement across enterprise SSO/identity infrastructure, identity remediation costs (forced resets, MFA re-enrollment, session invalidation at scale), IR engagement, and regulatory notification overhead if regulated data was accessible via stolen sessions. Frequency driven by: structural nature of the flaw (no need to compromise the software, only serve a web page), active researcher disclosure increasing attacker awareness, and absence of confirmed patches at time of disclosure. Range width reflects high uncertainty in both vendor patch timelines and organizational exposure depth.
Illustrative estimate — not actuarially derived.
Insurance / Contractual / Legal — Potential Obligations
Potential triggers, not legal determinations. Verify with counsel/broker before acting.
• Enterprise credential exfiltration via this pathway may trigger cyber-insurance incident notification obligations if employee or customer account credentials are confirmed stolen — verify with broker.
• If the AI browser tools are deployed under enterprise software agreements with data-handling provisions, credential theft through the vendor's product may implicate contractual breach or indemnification clauses — verify with counsel.
• If exfiltrated credentials were used to access systems containing regulated data (PII, PHI, financial records), applicable breach-notification requirements may be triggered — verify with counsel.
