AI browser bans and the top software flaws of 2025
Experts discuss Gartner's advisory to ban AI browsers due to significant security risks like zero-click attacks. The conversation expands to the role AI vendors should play in threat intelligence, the frustrating persistence of old software vulnerabilities on the MITRE Top 25 list, the conditional safety of social logins, and a novel 'bring-your-own-virtual-machine' attack that bypasses traditional endpoint security.
This discussion covers several pressing topics in cybersecurity, from the immediate risks of new technologies like AI browsers to the persistent nature of decades-old vulnerabilities.
Gartner’s Recommendation to Ban AI Browsers
The conversation begins with Gartner’s recent advisory for organizations to block AI browsers like Perplexity Comet for the time being. The panelists unanimously agree with this cautious, pragmatic stance. The primary concerns stem from the potential for sensitive corporate data to be leaked to AI service providers and the risk of the browser’s embedded AI agent being weaponized. A key example cited is a zero-click attack developed by Star Labs for Perplexity Comet, which could wipe a user’s Google Drive with a simple malicious email prompt.
Panelists highlight several key issues:
- Expanded Attack Surface: AI browsers introduce new vectors like prompt injection, data exfiltration, and zero-click exploits. These attacks can originate not just from emails but also from malicious prompts hidden on public web pages.
- Automation without Accountability: AI agents can read, write, and delete data without explicit, in-the-moment user approval, dramatically increasing the potential blast radius of an attack.
- Prioritizing UX over Security: Panelists note a trend where vendors prioritize user experience, leaving security as an afterthought. This necessitates a more reactive security posture.
To move forward, the experts suggest that AI autonomy should be treated like a privileged user, with defined permission scopes, decision logs, and proper isolation. While measures like human-in-the-loop verification and Google’s “user alignment critic” model are promising, the consensus is that the technology is too immature to be trusted in corporate environments. A collaborative effort between vendors and security professionals is essential to establish standardized guardrails, much like the evolution of cloud security.
The Role of AI Providers in Threat Intelligence
Following the discovery of an AI-powered espionage ring by Anthropic, a debate has emerged regarding the responsibilities of AI model providers. The panelists argue that since these providers now “sit in the middle of these attacks,” they inherit a new responsibility to the cybersecurity community. While some argue that Indicators of Compromise (IOCs) from AI models aren’t useful to most defenders, the panel suggests this view is short-sighted.
AI providers have unique visibility into pre-attack intelligence, such as malicious prompts and behavioral patterns, which defenders rarely see. The panel advocates for establishing a shared responsibility matrix, similar to the cloud security model, where AI vendors are expected to detect abuse, notify victims, and share aggregated threat patterns. Ignoring the AI’s role in the threat chain would be repeating the mistakes made during the early days of cloud adoption.
MITRE’s Top 25 Most Dangerous Software Weaknesses
The panel expresses a shared cynicism upon reviewing MITRE’s latest list, noting that decades-old vulnerabilities like Cross-Site Scripting (XSS) and SQL Injection remain at the top. This persistence is seen as a “report card of fundamentals that we get wrong,” indicating foundational engineering failures rather than a lack of technical solutions. The problem is described as cultural, with developers under pressure to ship features quickly at the expense of secure coding practices. Attackers exploit this predictability with a high success rate. The key takeaway for defenders is to use this list as a strategic blueprint and a “board-level strategic risk tool” to map against their technology stack and prioritize remediation.
The Safety of Social Logins (Consumer SSO)
The discussion explores the trade-offs of using social logins (e.g., “Login with Google”). While they offer convenience and are often more secure than users reusing weak passwords, they also create a centralized single point of failure. If an attacker compromises a primary identity provider account, they gain access to all connected services.
The consensus is that consumer SSO is conditionally safe. It must be treated as a security control, not just a convenience, and paired with robust protections like strong Multi-Factor Authentication (MFA), diligent recovery hygiene, and the adoption of passkeys. Passkeys, which use device-tied cryptography, are highlighted as a key technology for eliminating shared secrets and reducing phishing risks.
Bring-Your-Own-Virtual-Machine (BYOVM) Attacks
A novel attack detailed by Red Canary is analyzed, where an attacker uses social engineering (spam bombing and a fake support call) to deploy a malicious virtual machine (VM) on a victim’s system. The panel describes this as a sophisticated form of misdirection and persistence, creating “infrastructure within your infrastructure.”
This technique masterfully achieves the four truths of malware:
- Run: Code executes inside the VM, bypassing host-based EDR.
- Hide: The entire operating system is hidden, not just a process.
- Communicate: The VM uses its own network stack, with traffic appearing as benign virtualization activity.
- Persist: The VM itself is the persistence mechanism, surviving reboots.
Defenders must adapt by expanding visibility to virtualization layers, monitoring for unauthorized hypervisor activity, and detecting anomalous resource consumption (CPU, memory) that could indicate a hidden VM.