AI agents are always getting better at finding things, which includes sensitive information like your passwords, financial information, and API secrets if they are left exposed in obvious places. You may have been following the recent news coverage on OpenAI’s rogue agent attacking the Hugging Face servers during an evaluation. But you may not have noticed that tucked in OpenAI’s public disclosure on the hack is an admission that its AI models have been targeting publicly exposed online credentials even before this incident. The day after OpenAI’s disclosure, Anthropic came forward with a report of similar incidents with multiple Claude models dating as far back as April of this year.

A few years ago, Security Magazine reported on a study that found up to 24 billion username and password combinations circulating on the dark web in 2022. This doesn’t even begin to account for all the exposed tokens, secrets, and API keys sitting in public repositories across GitHub or Hugging Face. All of this information is accessible to anyone with an internet connection—but thanks to the processing power of agentic AI, they can now be discovered and executed at record speed. 

Info stealers who specialize in this kind of breaching regularly use AI-powered tools to scrape publicly exposed user credentials. Now—as we have just seen with OpenAI—apparently large language models can even find and use these exposed logins of their own volition. So how does one protect their user accounts on online platforms? First, you have to see if your credentials have been exposed. Then you have to take immediate steps to remediate them.

Why the OpenAI agent went rogue

OpenAI public disclosure on Hugging Face security breach Credit: OpenAI

According to OpenAI, one of its GPT-5.6 Sol agents was being evaluated on a platform called ExploitGym, which benchmarks large language models by asking them to write proof-of-concept security exploits for known vulnerabilities. Normally, ExploitGym is designed to be a closed ecosystem for proof-of-concept testing only, and AI agents shouldn’t have access to the internet while being evaluated. 

But this agent found a zero-day vulnerability in a package registry tool called Artifactory, then used it to gain access to the web. From there, the OpenAI agent gained access to Hugging Face’s company systems using publicly exposed credentials across four separate services. It went on to spend two days inside the company’s internal systems, managed to secure root access to several production servers, and even enrolled 181 attacker-controlled devices into Hugging Face’s corporate network. 

As for how the AI agent was able to get past the model’s usual safeguards, OpenAI noted that due to the nature of the ExploitGym evaluation, the agent was operating on instructions that reduced cyber refusals to successfully evaluate the model. OpenAI’s disclosure notes that this issue isn’t limited to Hugging Face: It’s since found instances where its agents found and used leaked credentials across different platforms. Now the AI company is collaborating with Hugging Face to uncover more details about the attack and prevent further instances like this one. 

Anthropic issues public notice on three separate security incidents Credit: Anthropic

Following the OpenAI reveal, Anthropic issued a public notice announcing it had begun a large-scale review of its own cybersecurity transcripts, which had already revealed similar attacks aimed at three separate organizations on different occasions, including Hugging Face. The attacks involved a different Claude model each time: Opus 4.7, Mythos 5, and another undisclosed research model. Like the OpenAI Hugging Face breach, Anthropic’s attacks also involved AI agents escaping controlled test environments to gain internet access during model evaluations. 

But in this case, Anthropic claims that the test environments each had a configuration error that left the Claude models with internet access, which was not part of the evaluation protocol. It seems they didn’t even need to uncover or target an exploit in the evaluation environment because the misconfiguration was already there.

Where do AI models find exposed credentials?

Researchers uncover more than 1,500 exposed API keys on Hugging Face Credit: Lasso Security

While using AI to scrape for exposed data is a new problem, the data leaks themselves are not. However, agents make it faster and easier to find leaked credentials because they can go through a large amount of information at record time or even execute hacks on autopilot. There are a few common routes that AI-automated scraping usually happens through, all of it to do with one or another form of human mistake leading sensitive data to become accessible in the first place.

Public data breach dumps

Right after a major data breach or cyber attack, dump files containing huge numbers of compromised usernames, passwords, emails, and other sensitive data end up on dark web forums and marketplaces. They are searchable and often openly accessible, which means agents can find them just as easily as a human attacker can. 

In June 2026, a database with over 24 billion credentials just surfaced on an Elasticsearch cluster, cross-referenced with live vulnerabilities to make it easier for hackers to pick low-hanging targets. There was another major data breach that led to 16 billion leaked credentials in mid-2025.

Exposed credentials in source code

Developers often commit API keys, tokens, and passwords to public coding repositories by mistake, especially when they’re in a rush or using vibe coding tools for assistance. If a human being were to scroll GitHub or Hugging Face, they wouldn’t see these credentials out in the open. But if any hacker or AI agent decides to peek underneath for the source code, those credentials are easily reachable. In 2023, Lasso Security uncovered more than 1,500 exposed API keys on Hugging Face, many of which belonged to major tech companies like Meta and Google. 

Targeted prompt injection attacks

Even if your credentials aren’t exposed in advance, prompt injection has made it incredibly easy to break into someone’s device and scrape for any user credentials and logged-in accounts within reach. Hackers can manipulate AI agents with access to your local storage to search for unprotected passwords and browser session cookies, which can then be fed remotely to attackers who can use them to breach your private accounts. If your AI agent has access to your local device and web browser, you’re especially vulnerable. In some cases, a remote hacker may fully take over your system and quietly run surveillance without you even realizing. 

How to check your current exposure

Have I Been Pwned lets you scan your email and passwords against known data leaks Credit: Have I Been Pwned

You may not even know if your credentials end up on a public database or open source code file, or if you’re the subject of a prompt injection attempt right now, unless you use specific tools and strategies to monitor your data leakage. Based on the three exposure points we discussed earlier, here are some tools and strategies that work for identifying and plugging potential leaks: 

Search your email and password against known data breaches

Have I Been Pwned maintains a continuously updated library of known info steals and data breaches. They pulled 56 million email addresses from stealer logs in a single batch in June 2026 alone. It’s also entirely searchable and free to use. 

You can search by either email address or password to see if your credentials are compromised from a recent data leak. If you’d like to search multiple email addresses across a shared domain that you own, you can get a paid subscription for as little as $4.39 per month. This also gives you access to their API, along with a live monitoring service that constantly checks your domain against new breaches as they happen. 

Scan your code repositories for exposed secrets 

If you write code, own a website, or maintain any public repositories, there’s a good chance that private credentials like passwords or tokens may end up in your public-facing source code files due to human error or technical issues. 

You can run free tools like TruffleHog or Gitleaks against your public repositories, cloud storage systems, wikis, logs, and databases to scan for exposed secrets. They can alert you even if an exposed credential was removed from your live repository but still exists in a publicly accessible version history. 

If you own a WordPress site with lots of plugins or themes, you can find similar vulnerabilities using WPScan. GitHub repositories also have access to their own built-in secret scanning tool, which can scan your repos for compromised API keys in a few clicks. 

Review your AI agents for permissions and connected apps

Prompt injection attacks don’t rely on publicly available or exposed credentials but instead target the AI agents that have access to your devices and applications. For users who rely on platforms like ChatGPT Work, Claude Cowork, Microsoft Copilot, etc., you should regularly review your AI platform to see what files and services it has access to. Generally speaking, it’s always better to restrict privileged access unless the specific job demands it, so your agent can’t just poke around in your file systems or hand over access to connected online platforms that you have accounts with. 

Another thing you should do is review your AI platform’s activity logs to make sure it’s not doing anything that you haven’t authorized, like accessing folders on its own or exchanging data with sources you haven’t approved. If you see anything suspicious, revoke permissions immediately to avoid further damage and change your compromised account credentials. 

What to do if you’ve been exposed to AI scraping

You should decommission your old accounts when you stop using them Credit: LinkedIn

If running these checks triggered a detection, you need to take immediate action to prevent your accounts from being compromised any further. Here’s what to do if you realize you might be exposed to AI scraping.

Reset the password, then sign out of all sessions

If you suspect a password has been compromised, either through public data leaks or prompt injection attacks targeting your device, the first course of action is to log into your account and reset that password. You can use a random password generator to create one that’s hard to guess, ideally with a mix of numbers and symbols along with text. 

Once the password has been reset, look for an option that says something along the lines of “log out of all sessions.” If not, see if your account has a “manage devices” option for individually managing any signed-in device sessions. Make sure that you’re logged out of every device and session, so that attackers don’t retain access in case they have already breached your account. 

Rotate your API keys and tokens the moment a leak is suspected

If your compromised data includes any API keys, tokens, secrets, or other developer credentials in publicly accessible source code, don’t wait until a cyber attack occurs to reset them. It’s best to assume that an attack is likely if it’s not already taken place, so replace your credentials with new ones at once. 

But don’t stop there. Search every bit of your live code, CI/CD logs, chat exports, and shared documents and files to see if the same key or token has been reused elsewhere. If it has, reset each instance of the leaked credential so that attackers can’t run a brute-force attack against all your accounts using the compromised secret.

Use an authenticator app or security key instead of SMS

Two-factor authentication (2FA) is a fundamental security stopgap that prevents most account takeover attempts during cyber attacks. Even if a hacker manages to secure a compromised password, they can’t actually get into your accounts unless they also have access to the one-time code from your authenticator app or your private security key. 

For even better security, avoid using SMS authentication when enabling 2FA. SMS messages can be easily intercepted through SIM-swapping, which is less of an issue if it’s just your password that’s been compromised but a much bigger problem if your accounts end up in a massive data dump after a breach at a major company. 

Authenticator apps like Google Authenticator, Bitwarden, 2FAS, Authy, etc. offer much better security because they’re locked to your specific device and account. Physical security keys are also a great option that insulates you from all forms of digital attacks altogether since logging in requires access to a piece of physical hardware. 

Don’t hardcode your credentials into a repository

Even if that GitHub project is just for testing, hardcoding your secrets and tokens into a public repository will make it simple for agents to scrape your login credentials for attackers. Instead of pasting your API keys directly into script files, use environment variables or dedicated secret managers. 

When assigning permissions to AI assistants, follow least privilege principles

AI agents or browsers like ChatGPT Work, Perplexity Comet, Dia, or Claude Cowork live directly on your desktop and execute tasks like coding, file management, and web browsing autonomously. But if you give them blanket access to your whole device, prompt injection attacks can easily steal files that store your credentials or active cookie sessions from logged-in accounts in your browser. 

Relegate your AI agent’s access permissions to a single controlled file system or folder. For everything else, approve requests on a per-task basis to avoid automatic prompt injection attacks from executing. 

Decommission old accounts when you stop using them

When you stop using online accounts but don’t actively delete or decommission them, they continue to sit in a company database along with your old password, payment details, and other personal information. These dormant accounts on online platforms are a favorite target for AI-augmented info stealers, who find them easier to exploit due to reduced security measures and outdated authentication. 

When you stop using an account, make sure to use the platform’s built-in "close account" or "delete account" option to permanently remove your information from their database. If these options aren’t available in the platform’s UI itself, it might be worth shooting an email to their customer support team to get the account decommissioned, even if that feels like a bit of extra hassle. 

Some companies will still keep your data on file for compliance reasons for a set period after decommissioning the account, but that’s usually not an indefinite amount of time, and your account won’t be sitting open to exploitation in the meantime. 

Email aliases were once a niche privacy trick. Now, though, they're a mainstream solution offered by any number of major email service providers, including Apple, DuckDuckGo, SimpleLogin, and Firefox.  Getting a basic alias set up and running to conceal your real email address is easier than ever—but given recent data leaks and sophisticated cyber attacks, it's increasingly clear that a basic setup only gets you so far.

That’s why cybersecurity experts now recommend having a nuanced email alias strategy that combines multiple aliases and secure authentication protocols to keep your real inbox away from prying eyes. As a journalist often working on sensitive topics involving security and compliance, I’ve been using email aliases for almost a decade. Here are some tips that have saved me a lot of privacy hassle over the years.

Why you should use email aliases

"Email aliases" refers to swapping your real email address with a stand-in that can forward emails to your primary inbox. That way, senders don't need to know your real email to communicate with you, and you can easily decommission aliases if they are targeted by too much spam.

Email aliases have been a standard practice for users who have to communicate sensitive information and maintain a degree of privacy, like journalists, lawyers, corporate executives, and public figures who expect to be targeted by spammers and cyber attackers. However, they don't replace real account security and won't stop anyone from breaking into your account if they somehow find your real email address.

Moreover, recent technological developments have made email aliases harder to maintain due to deliverability issues and data leaks. It's still fine to use email aliases to keep your inbox private, but you need an actual strategy to preserve your privacy now that spammers have grown much more sophisticated.

Why your email aliases need a strategy

Email aliases hide your real address from the recipient, but not from your email provider or anyone determined to cross-reference your details from leaked data. So if you use the same alias everywhere or route every email to the same inbox without other safeguards, your email only looks private. Determined attackers can and will find ways to exploit that single point of failure. 

Then there’s the other issue that no one warns you about. Most modern email services, including Gmail and Outlook, have built-in identity verification and will send shared alias domains straight into spam. If you want to get around this, not only do you need to set up your own custom domain for email aliases, but also properly configure your domain with authentication protocols like SPF and DKIM. 

And finally, your email alias provider itself may be compromised, revealing your forwarding address through email headers, as in the case of Apple Mail. Alias providers may also have other points of failure, like the broken sync features in ProtonMail that many have complained about. So relying entirely on a single provider without a custom domain setup is a major red flag. 

Clearly, you need to plan out your email aliasing strategy from the beginning to avoid missing important emails, being relegated to the spam folder, or leaking your private inbox through faulty technical implementation from your email service provider.

Segment aliases by service, not only by relationship

Most users prefer to maintain a bunch of aliases dedicated to different relationships, like one for personal emails, one for their work colleagues, one for scheduling meetings and appointments, one for streaming services, and so on. This works fine as a convenience hack to keep your inbox clutter-free, but it doesn’t insulate an alias if one of the services or applications associated with it experiences a data breach. 

For example, if you had a single email alias that you relied on for all your banking and financial activity, Experian’s infamous 2015 data breach could have compromised all your financial services using that single vulnerability. 

Privacy-conscious experts recommend maintaining a separate email alias for each service, such as one for Netflix and a completely different one for Apple TV, then bundling them under a single subdomain on your custom domain that’s specific to streaming services. That means your Netflix alias ends up looking something like yourname.netflix@streaming.yourdomain.com. So if one platform experiences a breach, your other aliases for similar services still remain private. 

Don’t rely on "plus addressing" if you want privacy

A common way to generate email aliases is to simply add a + sign next to your real email, such as yourname+streaming@yourdomain.com. This is fine for decluttering your inboxes, but doesn’t actually secure your email address because anyone can guess your real email address by removing everything after the + sign. 

Instead, it’s better to use a combination of randomly generated words or hashkeys. If someone sees an email alias that reads LJzcR7cHhZ9Q3sW4MTJk@yourdomain.com, that doesn’t do anything to help them figure out the other email aliases on that same domain. This is especially useful if you aren’t using a custom domain yet and relying on a shared domain from your email provider or aliasing service, because those are even easier to guess. 

Use a custom domain if you’re going all-in on aliasing

Relying on your alias provider’s shared domain, like @simplelogin.io or @gmail.com, is problematic for at least a couple of reasons. For one, it makes it near-impossible to divest from that domain if you ever want to switch to a different email or alias provider. Whereas if you use a custom domain, you can just point that domain to your new aliasing service if the old one is no longer safe or convenient. 

But aside from being locked into an email or alias service, you may also hurt your deliverability rates: A lot of these domains have poor spam scores that don’t pass most inbox filters. With a custom domain, you can set up your own domain authentication via SPF, DKIM, and DMARC. That way, inboxes assign you a separate spam score based on your own email activity, not the collective behavior of everyone else using that shared domain. 

This is why a custom domain is a worthy investment if you want to keep using email aliases as a long-term privacy tactic. You have better ownership of your data and can set up business-level security features that aren’t available to free shared domain emails. 

Pay attention to the email headers

Here's what happened with people using the Hide My Email service in Apple Mail before July 7: Normally, Hide My Email generates a random two-word alias to conceal your real email from recipients, but due to a technical flaw, an attacker could easily uncover your real address by targeting your inbox with spam mail. They would simply spam your alias and wait for Apple Mail’s filters to respond back with a rejection notification, which would contain your real email address right there in the email header.

Whenever you receive an email forward from your aliasing service, expand the header section to make sure your real address isn’t revealed in the email metadata. (On Gmail, it’s the little dropdown next to the recipient name at the top of your mail.) If you see a "Forwarded-To" field with your real email in the message header, that means you have a leak. 

Back up your alias lists frequently

Many providers bundle their email aliases with a password manager for easy access management, but that comes with its own risks. 

Several users on the Privacy Guides forum note that they accidentally deleted all their SimpleLogin aliases when trying to clear the Proton Pass logins associated with those accounts. Apparently, Proton has an auto-sync feature connecting the two services that works both ways. It’s even worse if you’re not using a custom domain, because then those aliases are lost for good unless you can reacquire them. 

You should regularly back up your list of email aliases in a text document or spreadsheet so that in case they end up getting deleted, you can create fresh ones with identical names and prevent important emails from bouncing off. 

Poison old email aliases before decommissioning

Many email providers retain records of your deleted account data for months or even years to comply with legal regulations. This makes them a common target for data brokers who scrape these accounts for any useful information. Luckily, there’s a simple fix. 

When you’re about to delete an old email account or alias, make sure to replace any personal details associated with that account with random values before you shut it down. This includes your name, address, date of birth, and any associated payment details that could be used to single you out. 

Keep a non-aliased backup contact method 

With many popular email providers like Gmail and Outlook cracking down on email aliases, you’ll often encounter a situation where using an alias to communicate is simply not feasible. Many inboxes have spam filters that bounce emails sent from random aliases or refuse to honor forwarding requests from your alias provider. It’s a compounding effect as well, because the more that email services reject emails from an alias, the worse it is for your alias’ reputation and deliverability rates. 

For banking platforms, important package deliveries, legal communications, and other priority email messages, consider maintaining a direct inbox that does not hide behind an alias or rely on email forwarding to receive messages. This can serve as a fallback for situations where missing an email is just not an option.

Uninterrupted browsing used to be a lot simpler: Disable all third-party cookies, blacklist known tracking domains, and get an ad blocker. But now, online platforms can pick up on things like your screen resolution, basic hardware specs, time zone, and installed fonts to establish a fingerprint unique to your browser and device. Websites can query a lot of seemingly harmless data from your device without prompting any security reaction, which, over time, they can use to trace your browsing activity. 

If you truly care about your privacy, disabling cookies is no longer enough to guarantee your anonymity on the internet. Luckily, browsers like Safari, Firefox, Brave, and others have evolved to address this problem using more privacy features that cost nothing to enable. Let’s take a look at how these work and what you can do to minimize your digital footprint. 

What is browser fingerprinting? 

Browser fingerprinting is an advanced tracking method where a website queries minute technical details about your device, anything from your operating system to the drivers used by your GPU, to create a unique digital identification for your browser. It then uses this ID to record your on-site sessions and trace your browsing activity across the web, completely bypassing the need for cookies. And while browsers now include powerful blockers preventing websites from installing cookies on your device, even dedicated security solutions like internet security apps, private browsing modes, and VPNs struggle to fully stop browser fingerprinting.

Unlike cookies, fingerprinting does not require a website to install files or extensions to your web browser. Instead, it uses server-side and JavaScript-executed signals to collect innocuous details about your device and setup, such as: 

• Canvas fingerprinting: A simple JavaScript command forces your browser to draw a hidden 2D image. It then hashes the pixel data to uncover specific details about your graphics card, operating system, hardware drivers, and so on. 

• WebGL rendering: Instead of rendering drawings on a 2D canvas, this forces the browser to render a 3D image in WebGL, revealing even more details about your graphics processor make and model. 

• Font enumeration: By rendering specific text strings and measuring bounding box layouts, APIs map out the entire font library installed on your system.

• AudioContext cues: This processes a silent audio signal through your sound hardware, creating a soundwave signature that’s unique to your device. 

• Hardware details: Device hardware specifications are considered low-hanging fruit that most fingerprinting APIs can pull easily. Things like screen resolution, storage space, battery levels, processor cores, etc. can be cobbled together to craft a unique digital ID. 

Checking your own browser fingerprint

I checked my own browser fingerprint using EFF's Cover Your Tracks. Credit: Electronic Frontier Foundation

If you’re curious about what kind of data your browser might be leaking to websites, Cover Your Tracks lets you run free scans that show you exactly how exposed you are. You can also rerun this check as many times as you want after adjusting your privacy settings. The site generates an immediate report that tells you whether you have cookies or trackers enabled in your browser, along with the types of data your device is leaking that can be accessed by fingerprinting technology. 

For example, scanning my Chromium-based Arc Browser revealed that I was leaking 18.26 bits of identifying information including my time zone, language preferences, font library, and privacy settings in the HTTP headers when accessing a site, as well as a unique fingerprint tied to my device through Canvas and WebGL rendering. This was after already disabling cookies or trackers at the browser level. 

How to prevent browser fingerprinting on Chrome, Edge, Firefox, Safari, and others

You can’t fully stop browser fingerprinting because the technology does not rely on a single point of access to collect your data. But that doesn’t mean you can’t make it harder for sites and trackers to get to you. Let’s take a look at how each browser handles fingerprinting, with step-by-step instructions on what you need to configure or enable manually:

Safari

Credit: Apple

Apple introduced Advanced Tracking and Fingerprinting Protection in Safari at the same time as the release of iOS 17 and macOS Sonoma. The company has also heavily expanded the feature since its original release. As long as you’re on Safari 17+, you can enable this opt-in feature for added privacy when browsing the web: 

On iPhone and iPad

1. Navigate to Settings > Apps > Safari > Advanced. 

2. Tap Advanced Tracking and Fingerprinting Protection.

3. Select All Browsing. 

On macOS 

1. Launch Safari. Then navigate to Safari > Settings from the menu bar.

2. Click the Advanced tab. 

3. Make sure to enable Use advanced tracking and fingerprinting protection and choose All browsing from the drop-down menu.

Edge

Credit: Edge Browser / Microsoft

Microsoft Edge offers fingerprinting protection even at the lowest privacy settings, without requiring any action on your part. However, you can enhance the level of protection by following these steps. 

1. Launch Edge on your Windows computer, click on the three dots in the upper right corner, and navigate to Settings > Privacy, search, and services.

2. Look for the section that reads Tracking prevention and opt for the Strict option for the maximum level of security from fingerprinting and cryptomining. 

3. You can also scroll down to Exceptions to whitelist trusted websites that need tracking enabled to work properly.

Firefox

Credit: Mozilla Firefox

Firefox bundles all its privacy features under Enhanced Tracking Protection, which covers both fingerprinting and cookies. There’s even a privacy.resistFingerprinting flag available for advanced users in the hidden config page, but that’s overkill for most regular users and can disrupt basic functionality on many modern websites. 

For most internet users, enabling the following features should be sufficient protection against most fingerprinting APIs: 

1. In Firefox, go to Settings > Privacy & Security.

2. Under Enhanced Tracking Protection, select Custom. 

3. Make sure the boxes next to Cookies and Fingerprinters are both checked. Fingerprinter blocking should also be set to All windows to extend protection beyond incognito browsing. 

4. For even stronger security, select the Strict option instead of Custom under Enhanced Tracking Protection for the most potent privacy settings.

Brave 

Credit: Brave Browser

Though it’s Chromium-based, Brave’s developers have gone out of their way to implement strong fingerprinting protection into the browser using the Shields component. This is one of the strongest out-of-the-box fingerprinting prevention settings that I have tested, and it's very easy to enable. 

1. Click the lion icon in the address bar of your Brave browser window to access Brave Shields. You can also do this by navigating to Settings > Shields. 

2. Make sure that Trackers & ads blocking is set to Standard or higher.

3. Fingerprint protection is now enabled. Brave Shields works by effectively scrambling any data collected by fingerprinting APIs, so trackers cannot obtain any consistent information to establish a profile for your browser.

Chrome

Credit: Fingerprint Spoofer / Chrome Web Store

Now for the elephant in the room: since Google shuttered its Privacy Sandbox component in April 2025, Chrome does not offer built-in fingerprinting protection. However, there are several third-party extensions you can use to add these features to your browser, with caveats.

• Canvas Blocker: When a website uses the HTML canvas element to create a unique fingerprint for your device, Canvas Blocker adds some random noise to the data generated by the canvas element to confuse fingerprinting APIs. It’s relatively lightweight compared to similar extensions because it doesn’t block your canvas element entirely and instead uses subtle changes to confuse fingerprinting trackers.

• Fingerprint Spoofer: A much more complete anti-fingerprinting extension, since this also blocks JavaScript and image-based fingerprinting and can spoof user agent or navigator values. It also entirely replaces the canvas image generated by your browser instead of making minor alterations to it, which makes canvas fingerprinting even trickier. 

• StealthHound: This is a premium anti-fingerprinting extension that stops websites from probing for your hardware details, blocks canvas fingerprinting attempts, disables tracking scripts, and even gives you a risk signal to indicate how aggressively a website is trying to identify you. StealthHound operates entirely on your local device without sending information to any cloud-based apps or platforms to protect data sovereignty.

However, Chrome has implemented certain limitations in its latest Manifest V3 extension framework that affect how useful these third-party services can be. It now actively prevents extensions from injecting code into a web page before that page has finished loading, which often gives fingerprinting technologies just enough time to get what they need before spoofing mechanisms kick in. If you truly care about fingerprinting protection, Google Chrome is not the best option for you. For a Chromium-based browser with thorough fingerprinting protection, consider Brave.

Cybersecurity experts warn that about 10-20 years from now, quantum computers will have enough processing power to decipher common cryptography techniques like RSA and ECC, an event they call "Q-Day." These encryption protocols are the current gold standard in VPN tech, but when Q-Day arrives, they’ll no longer be enough. 

Post-quantum encryption (or PQE), which uses complex mathematical puzzles that even quantum computers struggle with, is your VPN provider’s answer to the Q-Day threat. But while Q-Day is still years away from actualization, PQE is a VPN feature you can enable today, to protect your data against hackers who might hold on to your encrypted data until quantum computers get strong enough to decrypt it. 

NordVPN, ExpressVPN, Mullvad, and others let you enable PQE right away with the click of a button. But is this future-proof encryption protocol necessary or worth the investment today? I’ll explain how it works, what it protects against, and which providers offer it so you can make up your own mind. 

How post-quantum encryption (PQE) works

When you access the internet through a VPN tunnel, it basically scrambles your traffic data into unreadable code that can only be unlocked using a cipher key. That key is then securely transmitted to your device using a VPN handshake. So anyone who doesn’t have access to the encryption key, including your ISP, will not be able to interpret any useful information from your network and data usage. However, this technology only works because hackers don’t have access to hardware that can decrypt the scrambled network data without the encryption key. With quantum computing evolving as quickly as it is, security researchers estimate that it will be powerful enough to fully decipher your encrypted data without access to the actual key.

Q-Day isn’t merely a distant threat. Attackers are already using “harvest now, decrypt later” (HNDL) attacks to hoard your encrypted network data so that they can decrypt it as soon as Q-Day arrives. That means they’ll suddenly gain access to years of private user data the second that quantum computers gain enough processing power through hardware improvements. That’s why in August 2024, the NIST standardized new encryption algorithms from an open competition that ran for years. Three models were found complex enough to resist attacks from quantum computers: ML-KEM (aka Kyber) for key exchange, along with ML-DSA and SLH-DSA for digital signatures.

If your work involves sensitive data, if you perform a lot of high-value financial transactions, or if you are in a regulated industry with strict compliance requirements, PQE is worth looking into. While its availability is limited to certain VPN providers on specific pricing tiers only, security-conscious businesses and professionals operating in sensitive industries will find it genuinely useful, so it’s not just a gimmick. 

VPNs that support post-quantum encryption

A lot of companies use the phrase "quantum-safe" in their marketing terminology, but not all offer PQE as a standard VPN feature. Right now, NordVPN, ExpressVPN, and Mullvad are three mainstream providers who offer PQE as an opt-in feature on several plans. 

NordVPN

Nord rolled out PQE in its Linux VPN app in 2024, followed by Windows, Android, and Apple operating systems. It runs on the NordLynx protocol with the ML-KEM algorithm layered on top of the existing Wireguard encryption. But that also means you can’t use PQE with NordVPN if you’re using a dedicated IP, Meshnet, or the OpenVPN protocol. 

Because PQE is available to all NordLynx users, you don’t need a premium subscription tier or add-on to access it. All existing NordVPN customers can enable it, whether you’re on the Basic plan or Prime. Here’s how to do it if you’re already using NordVPN: 

• On Windows: Open the NordVPN app, go to Settings > Connections. Toggle on Post-quantum encryption.

• On macOS: Open the app on your Mac device. Go to Settings, then navigate to the General tab and enable the Post-quantum encryption toggle. 

• On iOS, Android, tvOS, or Android TV: Tap your profile icon. From here, you can easily find the toggle for Post-quantum encryption.

• On Linux: Navigate to terminal. Run this command: nordvpn set pq on. 

ExpressVPN

Even before its NIST standardization, ExpressVPN was one of the first companies to offer the Kyber algorithm through its Lightway protocol as early as 2023. When the ML-KEM protocol was standardized, ExpressVPN upgraded its platform to adhere to the exact NIST standards with several improvements. 

Interestingly, ExpressVPN has PQE enabled on every user plan by default. However, you need to be using the Lightway protocol and not a legacy alternative like OpenVPN. If you aren't sure if PQE is enabled, here’s how to check: 

• Open the ExpressVPN app. 

• Make sure you’re on the latest version of the app.

• Click on Settings. Navigate to the Protocol tab. 

• Check if one of the following options is selected: Automatic, Lightway UDP, or Lightway TCP. If not, just choose any one of them to enable PQE. 

Mullvad

Mullvad introduced a pilot version of its post-quantum encryption key exchange protocol way back in 2017, but the experimental implementation was replaced by a new version based on the Classic McEliece algorithm on top of all existing WireGuard servers. With the 2023.3 launch of its desktop app, Mullvad launched a fully stabilized PQE feature while extending support for Android and iOS.

Mullvad doesn’t have a feature-based pricing tier to worry about. Every paying customer has access to this feature with no add-on purchases necessary. It should be enabled by default on desktop unless you specifically opted out of it, but a manual opt-in is necessary on smartphone apps. You can do this by following these steps:

• On Windows, macOS, and Linux: Go to Settings > VPN settings > WireGuard settings. Make sure that the Quantum-resistant tunnel option is switched to On. When the VPN is connected, you should see a string of green text that reads: “QUANTUM SECURE CONNECTION.” 

• On Android and iOS: Launch the Mullvad VPN app. Go to Settings > VPN settings. Find the Quantum-resistant tunnel option, then toggle it on. 

Does it make sense to use PQE right now?

There’s no downside to enabling post-quantum encryption if your VPN provider already supports it on your existing plan. I didn’t notice any meaningful latency or speed drops when testing the feature on NordVPN and ExpressVPN. But if you’re wondering if it’s worth switching to a different plan or provider just for PQE, the answer depends on what your typical workflow looks like. 

Quantum computers are still years away from being able to decrypt current security protocols like RSA and ECC, even by the most generous estimates. However, HNDL attacks are a big enough security red flag that companies or people operating in sensitive industries and dealing with confidential information should be paying attention. For regular browsing workflows, PQE may be overkill. But when dealing with financial data, accessing healthcare portals, or sending sensitive information that you can’t afford to have intercepted, quantum protection offers additional peace of mind.

For the past few days, I’ve been poking around every AI browser I could get my hands on. So far, I’ve performed general research tasks on Perplexity Comet and used ChatGPT Atlas to successfully navigate an Amazon checkout. I even spent some time familiarizing myself with the new Dia browser from the developers of Arc.

As I've explored these browsers, I've been mindful of the many security risks to contend with: Prompt injection, where malicious AI prompts are hidden in a website or browser extension’s HTML source code, is the most obvious threat. But there are also cases of AI agents acting without a user’s permission to access your logged-in accounts. Moreover, AI browsers can leak data between browser tabs and hand over user credentials on clever prompting without even using any malicious code. 

But despite the risks, there are legitimate ways to experiment with AI browsers without compromising your privacy. In fact, most of these browsers have optional features you can enable to both beef up your security and keep the apps from having more access than they need. If you're going to use an AI browser on your device, here's what you need to know to protect yourself.

What makes AI browsers a security risk?

A regular web browser can only open a page for you after you make the request. You still decide which sites to navigate to and what buttons to interact with. With AI browsers like Atlas or Comet, the browsers themselves scan and analyze a web page for you, summarize information, and even act autonomously to execute tasks in agent mode. These things make AI browsers very convenient for daily use, but they also expose them to new vulnerabilities, as attackers can now manipulate the browser to access your accounts and data much more easily. 

AI prompt injection is the most popular example, since bad actors simply need to hide malicious instructions within websites for it to work. Even the official OpenAI documentation warns against using Atlas with production data because of prompt injection fears. Worse still, prompt injection attacks require no compromising action on your part. Simply navigating to a web page that has these AI prompts hidden in layers of source code is all it takes. You won’t even see the malicious instructions while you’re browsing the web page, but your browser will read the invisible instructions and automatically do what it tells them without asking for verification or consent from you.

Brave’s security team used several prompt injection attacks to demonstrate issues with Perplexity Comet, which has since been termed CometJacking. In one particular case, Comet dug up its user's email address, obtained a one-time password from their inbox, and forwarded it to an attacker without anyone the wiser. All it took was a request to summarize a Reddit thread that had malicious prompts hidden in it. 

ChatGPT Atlas has also revealed similar vulnerabilities. Security researcher Johann Rehberger got the browser to switch from light mode to dark mode using a simple command hidden inside a Word document that he asked the browser to read. As LayerX explains, Atlas is also susceptible to cross-site request forgery (CSRF), where a malicious web page can send instructions to your browser as if you had typed them yourself. Moreover, AI browsers don’t use the same blocklists and heuristics as traditional ones to flag known phishing websites, so they’re more likely to let you access a scammer’s website without blocking it. LayerX says Atlas users are 90% more susceptible to these types of attacks compared to Chrome or Edge users. 

Automated checkouts carry a direct financial risk. While AI browsers are relatively new, Amazon already won a court injunction to prevent Comet from completing checkouts for users on its websites, because it’s known to bypass certain security measures put in place to prevent financial fraud.

Enable built-in browser settings for better safety

AI browsers carry too many vulnerabilities and loopholes for regular usage, but that doesn’t mean you can’t use them at all without compromising your data. There are many built-in privacy settings you can enable for extra protection, along with some general best practices for safe browsing that can be particularly useful. Before you start using an AI browser, make sure that it’s configured correctly to get rid of the biggest loopholes that attackers tend to use. Here’s what I discovered to be most effective. 

Disable data sharing so AI browsers don’t train models on your data

Almost every AI browser uses your browsing patterns and search history to train future iterations of its AI models, so it’s effectively getting better at doing things by learning from your day-to-day tasks. That means all your browsing data is being sent to the browser’s developers by default unless you specifically opt out. Luckily, browsers that train models on your data also give you the option to disable training, at least on paid plans. This is always the first feature you should turn off if you use AI Browsers.

• ChatGPT Atlas: Navigate to Settings > Data Controls and disable Improve model for everyone to disable model training. You can also selectively opt out of letting ChatGPT use your browsing history or audio recordings of chat sessions for model training here. 

• Perplexity Comet: Go to New Tab Page > Account > Preferences. Toggle off AI data retention to opt out of model training from Perplexity. 

• Dia: From your browser window, visit Settings > Privacy. Disable the option that says Share content data to improve Dia.

Keep your browser from accessing your logged-in sessions

Using the Logged out version of Agent mode with ChatGPT Atlas Credit: OpenAI/ChatGPT

As we saw with the Comet demonstration, AI browsers can be manipulated into accessing your logged-in accounts on different websites and retrieving sensitive information through prompt injection. Depending on their level of access, they can also go into your accounts to execute certain actions without your knowledge, like sending an email or downloading a file. 

In ChatGPT Atlas, you can specifically prevent the AI from accessing your logged-in browser sessions in Agent Mode, so that it’s forced to ask for your credentials each time it needs to log into an email account or social media profile. While there’s no exact equivalent to this feature with Comet or Dia, those browsers also offer controls that let you decide how much access your agent can have. 

• ChatGPT Atlas: When you start a new chat inside ChatGPT Atlas, choose Agent mode from the + menu. Right next to the + menu, you’ll now see a dropdown that lets you switch between Logged in and Logged out to control whether the AI agent has access to your logged-in browser cookies. If you choose to stay logged out, Atlas won’t be able to access your active sessions by default, instead prompting you to log in manually if your task requires access to a user account. 

• Perplexity Comet: In Comet, there’s no universal toggle that restricts access to logged-in sessions. Perplexity notes that Comet does not have access to your passwords since those are only stored in your operating system’s vault, but it can still use your active sessions to pull sensitive information from logged-in accounts or execute tasks using those accounts. So, your best bet is to use Incognito mode when logging into any websites with the Comet browser, so you don’t stay logged in after you quit. 

• Dia: Like Atlas and Comet, Dia is also vulnerable to CSRF, prompt injection, and memory poisoning attacks that allow hackers to hijack your logged-in account sessions. Like Comet, Dia does not have a dedicated Logged out mode, and the AI is designed to access all your logged-in sessions by default to automate web-based tasks. Once again, you should use the browser’s incognito mode whenever you log into an account. You can also navigate to Privacy and security > Delete browsing data from dia://settings/ to delete your existing session cookies and log out of all active accounts. 

Turn off persistent memory unless you really need it

With standard prompt injection attacks, AI browsers read an attacker’s instructions and execute them only a single time. But there’s a more sophisticated form of prompt injection called memory poisoning. Attackers inject malicious instructions into your AI’s account-specific memory, which is retained across all your devices in each and every session. For example, an attacker could use memory poisoning to have your browser leak your most recent emails each day, instead of just the one time it reads malicious instructions. Hackers can use this tactic to compromise your data and hijack access across multiple devices where you use the same AI browser, which is even more of a threat with cross-platform browsers like Comet and Dia. 

• ChatGPT Atlas: Go to Settings > Personalization. Toggle off Reference browser memories to prevent ChatGPT from retaining any memory from your previous chat sessions. This will effectively prevent it from getting better at your tasks by learning from your data, but it will also shield you from attacks that specifically target this feature. OpenAI notes that ChatGPT Atlas has built-in security filters that restrict access to sensitive information like government ID, bank account or credit card numbers, and SSNs. But disabling browser memories entirely offers much better safety. If that feels too extreme, you can also use incognito mode when performing any tasks that you’d rather not have relegated to your browser memory, or go to Settings > Personalization > View browser memories to delete or archive memories you don’t want retained. 

• Perplexity Comet: You can go to comet://settings/ > Privacy and security > Delete browsing data to clear your browsing history, cache, and cookies. To delete saved AI memories from your Perplexity account, you can navigate to New Tab Page > Account > Preferences > Memory, where you can choose to disable memory retention by toggling off Use search history and Notes. You can also click Manage memories to alter or delete specific memories. 

• Dia: If you click on the Personalization button in a new tab, Dia will take you to a page where you can adjust how memory gets used. Toggle off Personalize new chats so Dia can’t draw from its preexisting memory when you start new conversations. If you want to clear or disable memory retention altogether, you can go to Settings > Memory, then click Reset Memory or Disable Memory. 

Restrict what agents can access on sensitive sites

Restrict access to sensitive sites when using Comet Credit: Perplexity AI

With Atlas, hardcoded limits prevent the browser from running code, downloading files, installing extensions, or accessing your device’s file system by default. With Comet and Dia, things are kept more open-ended, though they both offer some protection from letting your agents handle sensitive financial data by default. But if you’d like to take this a step further, you can disable agent access to sensitive websites like banking and healthcare platforms, so that they can’t see anything or take actions on these sites. Doing this fully insulates you from prompt injection attacks aimed at these platforms. 

• ChatGPT Atlas: Go to Settings > Personalization. You’ll see an option called ChatGPT page visibility. If you click on it, you can add a list of websites where your agents won’t be able to access any data or take actions even when prompted. But you’ll still be able to access these sites using the browser manually. 

• Perplexity Comet: You can adjust Comet’s permissions on a more granular level to prevent it from performing specific tasks on certain websites. Go to Settings > Privacy and security, then take a look at the options under Comet Assistant to find Block personal search for these websites. This should give you more options to configure which websites Comet can navigate to and interact with, as well as whether it can access your browser history by default. 

• Dia: You can visit dia://settings/ > Privacy and security > Site settings to control all site permissions on an individual level. However, this does not prevent agents from seeing the data on these websites. To prevent Dia from gaining access to data from sensitive sites, it’s better to just avoid logging into any private accounts unless in incognito mode. 

A few additional best practices for AI browser safety

Generally speaking, the less data and permissions that your agentic browser has access to, the less damage it can do during an attack. Apart from the built-in security settings described above, there are some general best practices that I like to follow whenever using a browser like Atlas, Comet, or Dia:

• Keep using your regular browser, like Chrome or Firefox, for most day-to-day work. Maintain a separate profile for AI browsers with no sensitive logins just for running AI browsing tasks.

• Don’t download AI browsers or AI browser extensions from unofficial sources or third-party marketplaces. Hackers are floating a lot of fake and malicious software in this space, so keep to the official sources to reduce exposure. 

• Avoid accessing user-generated content platforms like Reddit with your AI browser, which are a haven for prompt injection attacks. But if you must do it, make sure to restrict your agents from seeing or accessing anything on these sites. 

• Don’t copy-paste long strings of text or URLs into your AI browser without verifying them first. Attackers can bury prompt injection attempts in longer URL strings. This is a very common exploit from hackers targeting Atlas’ Omnibox, the browser's search and prompt bar combo.

• When asking an agent to execute multi-step workflows, always keep an eye on what it’s doing and use the pause or interrupt controls to stop any suspicious activity as soon as you spot it. 

• For sensitive platforms like financial websites or workplace communication apps, enable two-factor authentication on your account to prevent agents from logging in without your knowledge.