AI access starts before the prompt: review the browser route
A legitimate task can start at the wrong address. Testing should follow navigation through requests to execute, install or change search.
Czytaj po portugalskuBy Pentesty
What the research identified
Island described TypoPrompting: AI lookalike addresses led to requests to run commands, install software or change search. The research also examined an extension whose manifest changed the search provider without needing executable JavaScript or declared permissions for that action.
For a corporate assessment, propose three separate decisions: selecting the service, approving an installation and accepting a browser change. Approval at the first stage should not automatically justify the others. This separation gives support a concrete question when someone reports that a tool requested an unexpected action before they could begin their work.
Start with the route people actually use
Choose a real task, such as reviewing a document, and ask a participant to show where they would start. Do they use a corporate bookmark, search, an old history entry or type a remembered name? Record the choice without asking anyone to visit suspicious addresses. The exercise assesses the working route already in use.
With the responsible team, propose a recognizable entry point for the approved service and test whether it is easy to find. Include someone who has just joined the company. If reaching the right place depends on informal instructions passed between colleagues, publishing the tool has not resolved how employees discover it safely in everyday work.
Make unexpected requests decision points
In a harmless prototype, present a training page that interrupts the task with an installation or execution request. The participant should be able to end the interaction and confirm the procedure through an already known support channel. Agree on the measurement beforehand, and include no actual commands, installers or credential collection in the exercise.
Compare the expected response with the instructions available at that moment. Generic advice to be careful can fail when a page claims the action is necessary for work. Rewrite the guidance as a usable decision: which request requires another approval, where to obtain it and how to resume the legitimate task without accepting the interruption.
Approve changes by their intended effect
Consider a request to add an extension for the sales team. Its owner should explain the task it serves, the settings it intends to change and how it will be removed. The proposed assessment compares that description with behavior in a test profile, including address-bar searches and the destination receiving those queries.
A synthetic search can use terms without business information and a profile without production sessions. Compare the state before and after approved installation and removal. If the result differs from the declared intent, stop acceptance and send the difference for review. Avoid making a short permission list the only evidence that the observed behavior is acceptable.
Include continuity and exception review
Imagine an approved tool changes address or its support team no longer exists. The catalog needs to provide a current decision, including when access should be suspended. Exercise withdrawal with the business-process owner: how does the employee find an alternative, and what happens to older shortcuts and instructions that still point to the original service?
Give management an assessment of the whole route: approved entry, requests needing another decision and browser changes accepted in testing. Separate discovery, documentation and configuration problems so each receives a specific remedy. The objective is to preserve the working task while the organization controls additional decisions introduced along the way, including how those decisions can later be withdrawn.
Frequently asked questions
Must the domains in the research be visited?
No. The proposed exercise uses work observation and synthetic pages without opening public indicators, downloading samples or executing third-party commands.
Does a corporate bookmark complete the assessment?
It addresses one part of the route. Also examine installation requests, configuration changes and the ability to find help without following instructions on an unexpected page.
How can search be tested without exposing internal data?
Use an isolated profile and synthetic queries without customer, project or system names. Define the expected result and compare observed destinations before and after the change.
Who decides on a business-critical extension?
Include the process owner, browser team and security team. The decision should explain the permitted effect and the alternative when installation is not approved.
Sources and references
Original Pentesty analysis, published November 12, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.