Threat · curated 28 Jun 2026
Hardening AI Web Agents: How We're Securing Tabstack Against Indirect Prompt Injection | Tabstack Blog
First reported tabstack.ai
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
It demonstrates a real, verified indirect prompt injection leading to data exfiltration in a deployed autonomous web agent, and offers a structural mitigation pattern defenders can apply.
Tabstack (Mozilla) disclosed an indirect prompt injection vulnerability in its /v1/automate web-agent endpoint, found by Brave researchers, where hidden white-on-white instructions on a target page caused the autonomous agent to exfiltrate the user's conversation history to an external form. The flaw has been patched with a structural 'action firewall' that classifies form interactions via DOM metadata and provenance rather than trying to detect malicious text.