Agentic AI Browsers: What Burnaby Owners Lock Down Now

Something changed in the past year and most owners around Burnaby and New Westminster haven't caught up to it yet. The browser sitting on the front desk can now click things.

Not suggest. Click. Agentic AI browsing means the assistant reads the page and then navigates, types, fills forms and submits them, using the sessions your staff are already signed into. Microsoft ships this in Edge. Anthropic ships it as a Chrome extension. If anyone on your team has a Microsoft 365 Copilot licence or a Claude Team plan, it may already be switched on.

Adoption isn't hypothetical either. Statistics Canada reported that 19.2% of Canadian businesses used AI to produce goods or deliver services in the 12 months before its second quarter 2026 survey, up from 6.1% two years earlier (Statistics Canada, June 2026). That same release found 13.4% of businesses named cybersecurity or privacy concerns as a barrier to using AI, second only to "not relevant to what we do."

Good news: the controls you need already exist, and they come with the licences you're paying for. Most offices just haven't opened the settings page.

Start with the allowlist, not the training session

Both major vendors landed on the same answer, which tells you something.

Microsoft's enterprise documentation for browsing with Copilot is blunt about the model: "Copilot can only browse on domains that you authorize through policy, and it respects existing DLP and policy configurations. Copilot requests user input for steps requiring authentication, and final saving and submitting actions" (Microsoft Learn). The policies are named `AllowBrowsingWithCopilot`, `BrowsingWithCopilotAllowList` and `BrowsingWithCopilotBlockList`. If the allowlist is empty, the feature doesn't appear at all. Blocked sites beat allowed sites. As of that page's June 2026 revision, the feature is still in preview, requires a Microsoft 365 Copilot licence, and is open only to tenants outside the European Economic Area.

Anthropic's admin documentation for Claude in Chrome does the same thing for Team and Enterprise plans. An owner sets an allowlist and a blocklist under Organization settings, and the guidance is to "Start with a more restrictive allowlist for the security of your organization's data, then expand access over time" (Claude Help Center).

That's your Q4 job in one sentence. Decide which sites an agent may touch, write them down, and leave everything else off.

Why the allowlist, and not smarter AI, is the defence

The attack is called indirect prompt injection. OWASP's Top 10 for LLM applications lists it as LLM01 and describes the indirect form as what happens when a model "draws from external sources like websites or files" and then acts on instructions buried in that content. OWASP's own conclusion is worth reading twice: "it is unclear if there are fool-proof methods of prevention for prompt injection" (OWASP GenAI Security Project).

Vendors agree, which is unusual. In a November 2025 research post on browser use, Anthropic wrote that "No browser agent is immune to prompt injection, and we share these findings to demonstrate progress, not to claim the problem is solved," and noted that even a 1% attack success rate, while a significant improvement, "still represents meaningful risk" (Anthropic).

Academic testing backs that up. Researchers Franziska Roesner and David Kohlbrenner at the University of Washington tested seven agentic browsers in late January and early February of 2026 and found that "the same-origin policy is reduced to the strength of an agent's defenses against prompt injections in multiple agentic browsers today" (UW Security and Privacy Research Lab). The same-origin policy is the browser rule that stops one website from reading another one's data. It has been load bearing since the 1990s. An agent that reads every tab and follows instructions it finds there can walk straight around it.

So a hidden line of text on a supplier's compromised invoice page can tell the agent what to do next. And the agent is signed in as your bookkeeper.

What six national cyber agencies published in May

On May 1, 2026, the Canadian Centre for Cyber Security joined CISA, the NSA, Australia's ACSC, the UK's NCSC and New Zealand's NCSC to publish "Careful Adoption of Agentic AI Services" (Canadian Centre for Cyber Security). It covers designing, deploying and operating agentic AI securely, and the agencies recommend "implementing a layered defence and strict access controls to reduce the likelihood of compromise" (CISA).

Nothing in it is exotic. That's rather the point. Here's the version that fits a 12-person office:

• Off by default, then granted. Empty allowlist first. Add sites as people ask, with a reason written down beside each one.
• Keep banking, payroll and your CRM off the list. No exceptions for convenience. Agents shouldn't be signed in where money moves.
• Give the agent its own browser profile. Separate profile, separate sessions, no saved passwords, no stored payment methods.
• Require a human on submit. Anything that publishes, purchases, emails a client or writes to a customer record waits for a person.
• Log it. If you can't tell which agent touched which record last Tuesday, you can't investigate anything.
• Write one page of policy. Approved tools, what may be pasted into them, who to tell when something looks wrong.

The BC privacy part people skip

British Columbia's Personal Information Protection Act applies to your business whether or not AI is involved, and the province's regulator is actively enforcing it against AI companies right now.

On May 6, 2026, BC Information and Privacy Commissioner Michael Harvey announced the results of a joint investigation with the federal, Quebec and Alberta regulators into OpenAI. The BC finding was "well-founded and unresolved" on consent, because scraping personal information from the internet without knowledge or consent "continues to fall short of meeting the foundational requirement for consent in PIPA" (OIPC BC). Harvey added that the report "highlights the fundamental disconnect between how one of the world's most widely used AI applications works and what BC's Personal Information Protection Act demands," and said he had written to the province urging it to modernize PIPA.

Read that as a weather report. If your agent opens a customer file and that content leaves your control, you own the consequences, not the vendor. Know where the data goes before you switch anything on.

Where this doesn't apply

There are real cases where agentic browsing is the wrong tool, and it's worth naming them.

If a supported API exists, use the API. Driving a web form with a language model is slower, costs more per task and breaks the moment the vendor moves a button. Agentic browsing earns its keep on systems that have no API and never will.

If your team is under five people doing varied work, the setup and supervision cost will probably exceed the savings this quarter. Statistics Canada found 40.0% of businesses said AI just isn't relevant to the goods they produce or the services they deliver. Some of them are right about that.

If you handle health, legal or other sensitive personal information, wait. Microsoft's own browsing feature was still labelled preview in its June 2026 documentation, and preview is not the maturity level you want between your staff and a patient record.

And the sources genuinely disagree on severity. Vendors publish improving numbers from their own internal test suites. Independent researchers keep finding new bypasses in those same products. Both things are true at once, which means you should plan for the agent being wrong rather than for it being safe.

Sources

• Statistics Canada. "Analysis on artificial intelligence use by businesses in Canada, second quarter of 2026." Released June 11, 2026. Link
• Microsoft. "Configure browsing with Copilot." Microsoft Learn, Edge Enterprise documentation, 2026. Link
• Anthropic. "Claude in Chrome admin controls." Claude Help Center, 2026. Link
• Anthropic. "Mitigating the risk of prompt injections in browser use." November 24, 2025. Link
• OWASP GenAI Security Project. "LLM01:2025 Prompt Injection," OWASP Top 10 for LLM Applications, 2025. Link
• Roesner, F. and Kohlbrenner, D. "Agentic Browsers and the Same-Origin Policy." University of Washington Security and Privacy Research Lab, 2026. Link
• Canadian Centre for Cyber Security. "Joint guidance on the careful adoption of agentic artificial intelligence services." May 1, 2026. Link
• CISA et al. "Careful Adoption of Agentic AI Services." May 1, 2026. Link
• Office of the Information and Privacy Commissioner for British Columbia. "Canadian privacy regulators' joint investigation into ChatGPT leads to improvements in users' privacy." News release, May 6, 2026. Link

Want a second pair of eyes before year end? Autana Solutions helps small and mid-sized businesses across Burnaby, New Westminster and Metro Vancouver find out which browser AI features are already live on their machines and lock down the ones that shouldn't be. Book a free call and we'll walk your actual settings with you, no slide deck required.