AI agents that can control and read data from an internet browser are also susceptible to obeying malicious text circulating in web content.