Agentic Browser Risk Gating for Prompt Injection and Data Exfiltration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The pervasive dependence on cloud computing environments and external servers for processing and storing personal data in agentic systems raises significant privacy and security concerns, with risks of prompt-injection attacks, credential exfiltration, and unintended side effects from untrusted web content.
Innovation Solution
A secured computing environment with a local large language model (LLM) that separates trusted and untrusted content, applies sanitization and redaction, enforces least-privilege permissions, and requires human approval for sensitive actions, using a capability broker and encrypted vector store to prevent data exfiltration and prompt injection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If untrusted content is ingested into the LLM context for processing, then the system can access and act on external information, but the system becomes vulnerable to prompt-injection attacks and credential exfiltration
Solution Approach 1:
The patent segments the LLM context into distinct fields: trusted system instructions, user goals, and untrusted page content. This segmentation allows the system to process external information while maintaining clear boundaries that prevent untrusted content from compromising system security. The context assembler specifically separates these components so that untrusted content cannot inject prompts into the trusted instruction fields.
Solution Approach 2:
The patent introduces a capability broker as an intermediary component that sits between the LLM and the tool execution environment. The capability broker validates tool calls against least-privilege permissions, scopes capabilities to specific sites and intents, and enforces time-window constraints. This intermediary prevents direct exploitation of untrusted content while allowing legitimate external information processing.
2Reliability
If the system enforces strict access control and content separation, then security against prompt injection is improved, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by sanitizing untrusted content before it enters the LLM context. The context assembler performs redaction, summarization, or removal of potentially harmful content in advance, and the capability broker pre-validates tool call permissions before execution. This preliminary processing reduces the burden on downstream security mechanisms while maintaining robust protection.
3Reliability
If the system requires human approval for sensitive actions, then prevention of credential exfiltration is improved, but productivity decreases
Solution Approach 1:
The patent applies partial action by requiring human approval only for sensitive tool calls that could exfiltrate credentials or perform high-risk operations, while allowing automated execution for routine, low-risk actions. The capability broker classifies tool calls by risk level and applies selective human-in-the-loop validation, maintaining security for critical operations while preserving productivity for safe automated tasks.
Data Source
AI summary
A computer implemented method for governing risk actions by an artificial intelligence (AI) browser, by classifying a proposed action by the AI browser based on a large language model (LLM) as safe or risky based on AI weights or based on policy rules; initiating a step up authentication flow for a risk action; presenting an action summary and required capabilities to the user for approval; and enforcing user configured spend or scope limits on the risk action.