AgentWatch: A Bodyguard for the AI Assistants Browsing on Your Behalf
A consumer app that sits next to a personal AI agent (ChatGPT browsing, Claude computer-use, Perplexity Comet) and warns the human user in plain language whenever a visited webpage is trying to manipulate the AI into revealing personal data, clicking hidden buttons, or following injected instructions.
Privacy-conscious consumers who use AI assistants with web browsing or computer-use capabilities
- Live 'injection attempt' notifications: 'This checkout page is asking your AI to autofill your full address — block?'
- Per-site trust score based on common prompt-injection patterns (hidden text, disguised form fields, suspicious instructions in page content)
- One-tap lockdown: pauses the AI agent if a high-risk instruction is detected
- Weekly digest of blocked attempts so the user understands which brands and sites are riskiest
Cross-site prompt injection is now an actively published attack class (Prismata paper, July 2026) and consumer AI browsers are rolling out to millions of non-technical users who have no way to know when their assistant is being steered.
Multiple recent papers, vendor warnings, and real-world incidents confirm rising concern: Microsoft flagged malicious AI extensions with ~900k installs, Anthropic calls prompt injection 'one of the most significant security challenges for browser-based AI agents,' and Prismata/BrowseSafe/Prompt Injection 2.0 papers all published in 2025-2026.Protect enterprise generative AI apps with prompt injection protection ↗Mitigating the risk of prompt injections in browser use ↗
All named competitors are enterprise/SSE-oriented (Microsoft SSE Prompt Injection Protection, Nightfall, Agdex) or dev-only (seojoonkim/prompt-guard on GitHub); no consumer-facing 'bodyguard' product that warns end users in plain language was found.Best AI Agent Security & MCP Security Platforms for Prompt Injection ↗GitHub - seojoonkim/prompt-guard ↗
Enterprise willingness-to-pay is clear (Microsoft/Nightfall pricing) but consumer-side is unproven; general consumers rarely pay for security add-ons and the AI-agent-browsing user base, while growing, is still small enough that freemium is the most realistic path.AI browsers could leave users penniless: A prompt injection warning ↗
Problem is structural to LLM-based web agents interpreting untrusted natural language as instructions, so it persists as long as agentic browsing exists; however, major vendors (OpenAI, Anthropic, Perplexity, Microsoft) are actively shipping native mitigations which could compress the standalone-app window.Mitigating the risk of prompt injections in browser use ↗Cybersecurity and privacy in LLM-powered AI browsers ↗
Most natural build is a browser extension that proxies/observes pages seen by an AI agent and runs an LLM-based classifier on suspect content — tractable for a small team but requires continuous model updates and per-assistant integration (Comet, ChatGPT browsing, Claude computer-use APIs differ).Prismata: Confining Cross-Site Prompt Injection in Web Agents ↗