As AI becomes a greater and more important presence in our everyday lives, the way we interact with the "traditional" internet is changing.
For so long the main way to access the internet, the web browser is now having to rethink how to appeal to an audience which often seeks AI-first interaction - raising new challenges for developers to create the best and most interactive experience.
We spoke to Ajit Varma, Head of Firefox at Mozilla, to find out more.
The open web matters more today than it has in years because AI is changing how people experience the internet. As a small number of platforms become the gateway to search, content and AI-powered services, it's becoming easier for a handful of companies to shape what people see and how they interact online.
That's why the principles of the open web still matter. Common standards mean developers can build without asking permission from a dominant platform, and users can choose how they access the web rather than being locked into a single ecosystem. Those principles have driven innovation for decades, and they're just as important as AI reshapes the internet.
The challenge now isn't simply keeping the web open as it exists today. It's making sure openness evolves alongside AI, so the next generation of the internet remains competitive, interoperable and accessible to everyone
Over the next five years, you’ll start to see more divergences in how browsers treat AI. Many companies will use the browser to try and push a specific AI agenda but at Firefox we’re focused on how AI can make the tasks a user wants to do in a browser better. This includes things like a personal agent that can help a user accomplish tasks, navigating the web through voice, making the web more enjoyable, and creating new vibe-coded extensions and mini-apps.
We’ll do all this in a way that is user centric. The browser should adapt to the user, rather than the other way round. Some people will want AI integrated into their everyday browsing, while others will prefer to use it for specific tasks. Maintaining trust means supporting those preferences and letting people decide how much they use AI.
Users should be able to choose any model they want including open and local models. The important thing is preserving that flexibility, so people can browse, search and get things done in a way that feels natural to them.
For me, striking the right balance starts with recognising that every user has different expectations of their browser. While context can make online experiences more useful and personalised, people should be able to understand how their data is used and decide what they are comfortable sharing. By giving users meaningful control over the features they adopt, Firefox can deliver modern experiences while continuing to protect their privacy.
This has guided our phased approach to AI, beginning with practical features such as summarisation, translation, tab organisation and optional AI chat integrations. Before introducing more advanced AI experiences such as Smart Window, we launched AI Controls so people can manage individual features or switch them off altogether.
Firefox is also model-agnostic, so users can choose or switch providers, use local models, or opt out entirely. Even though only a small minority of users disable AI features, people regularly tell us they value knowing the controls are there. Privacy and convenience can coexist when people are able to set the terms of the experience.
The biggest risk isn't AI itself, it's concentration. If the same companies control the AI models, the interface people use to access them and the browser they interact through, users lose visibility, choice and ultimately agency. That's a much bigger shift than simply moving from one technology generation to another.
What's encouraging is that the issue is becoming harder to ignore. Developers want open standards. Regulators are paying closer attention to competition. Users are asking tougher questions about transparency and control. The web has always evolved through periods of disruption, but it has remained resilient because it's built on interoperability rather than permission. AI can strengthen that model rather than replacing it with a handful of closed ecosystems. The future doesn't have to be a choice between innovation and openness. We should expect both.
AI is making it dramatically easier to build software, which means we're going to see more developers – and more people who aren't traditional developers – creating for the web. That's a huge opportunity, but only if they can build on an open platform rather than for a handful of closed ecosystems.
That's why the browser becomes even more important. It's no longer just where websites are displayed – it's becoming the layer where people interact with AI to search, create, organise information and complete tasks. As that layer becomes more powerful, it has to remain open, interoperable and centred around user choice.
For developers, that means being able to build for the web, rather than for whichever company happens to control the dominant model or platform. That's always been one of the web's greatest strengths, and it's something we shouldn't lose as AI reshapes how software is built and experienced.
Success, for me, is a web that's become more useful through AI without becoming less open. Technology should expand what's possible, not narrow the ways people can access information, build new ideas or participate online.
Innovation should continue to come from everywhere, not just a handful of dominant platforms. The web has always been at its best when anyone with a good idea can build something that reaches millions of people. That only happens when developers have open standards to build on and users aren't locked into a single ecosystem.
The web should still be the best place to build, discover and innovate because it remains accessible to everyone. If AI has expanded participation rather than concentrated power, we'll be heading in the right direction.
We differentiate through independence, choice and accountability. Most browsers are tied to larger technology ecosystems spanning across multiple systems, search, advertising and AI.
Instead, Firefox is powered by Gecko, the only remaining independent browser engine, which gives us the freedom to make product decisions around what benefits users. It ensures that Mozilla is not only advocating for these principles but actively building the underlying infrastructure that makes them possible.
That independence is commercially relevant because there’s such a clear demand for genuine choice. Firefox has been selected through EU browser choice screens more than six million times in two years and those users are five times more likely to remain with Firefox than people who find it organically.
Societally, independent engines prevent one company’s technical and commercial priorities from being the default for the entire web. They also preserve competition, interoperability and the ability to build around different values.
There are certainly some encouraging signs that regulation can restore meaningful choice. The impact of browser choice screens in Europe shows that people choose alternatives when they are presented fairly and without being steered towards a default.
However, AI is creating a new concentration risk. If the same small group of companies control the operating system, browser, search engine and AI model, it becomes much easier for them to shape how people access information and which services they encounter.
Regulation needs to keep pace not only with how AI is developed, but with how it's distributed and embedded into everyday products. However, regulation can't do this alone. Interoperability, genuine defaults and strong technical competition will matter just as much.
Trust starts with being clear about what the technology is doing. AI should be optional, transparent and designed so users can understand what information it can access, how it’s being used and who is acting on their behalf.
That’s the principle behind Firefox’s AI controls. AI features are optional and can be managed individually, while a single setting allows users to block current and future generative AI features. We also use on-device models for features such as Link Previews and Smart Tab Groups, allowing people to receive AI assistance without any data leaving their device.
Ultimately, trust isn't earned through a single feature. It's earned by being transparent about how AI works and consistently respecting the decisions people make.
It starts on the 4 Train, that straight-run subway line from Grand Central to Yankee Stadium, where I start to notice the red shirts. By the time I reach the massive gray stadium, people are circling the Bronx Bomber’s edifice like thousands of red ants, all queuing up for a rare baseball season sight: football (soccer) in Yankee Stadium.
Most of the shirts are for Premier League side Liverpool FC, but there's a smattering of Wrexham kits. Some of them look threadbare, and none feature the club’s newest sponsor: Firefox. The travel and away kits were unveiled just days before — too soon for die-hard fans to show their support for the team and its well-known but, by some measures, marginal web browser.
Walking through Babe Ruth Plaza, I follow behind the red shirts until I’m lined up behind fans who have come from as far as Arkansas and California to witness the pre-season match. None are musing about Firefox’s new Wrexham sponsorship or how Mozilla (Firefox’s parent) took over from United, which itself took over from TikTok.
The scrappy Welsh club enjoys outsized notoriety thanks to its owners, actors and entrepreneurs Rob McElhenney and Ryan Reynolds, and the popular Hulu docu-series Welcome to Wrexham, which recounts the club’s rise from the ashes and ascent to, as of last season, just short of Premier League status.
While we wait to enter the stadium, the Liverpool team arrives late — following a day of storms and flight cancellations — on a pair of giant red touring buses to hearty cheers from the crowd. Everyone knows Wrexham, but the fans seem to be with Liverpool.
As we file in, I have time to think about the connection between Wrexham and Firefox. The kits, which I view later in person and on the field, are quite fetching. On top of the bold, red stretchable fabric is the iconic Firefox flame. It makes me think of the heat Mozilla hopes to generate around its best-known product.
The fit, though, between a scrappy football team and a portal you use to navigate the web, seems tenuous and as ill-fitted as the rectangular pitch they’ve somehow jury-rigged onto the baseball diamond. A covered home plate, third base, and right field jut out awkwardly, and much later a fan tells me the pitch looked kind of messy and maybe not a great experience for some of the players.
It’s not that I don’t understand why Mozilla tied its sails to Wrexham. As I write this, Firefox sits, according to StatCounter, at 3.4% of the global browser market share. By contrast, Chrome has 69% and Safari almost 16%. Put another way, the browser wars are over.
It's not that Firefox is irrelevant, but it's not as relevant as it once was. There was a time, maybe 15 years ago, when I was firmly in the Firefox camp. I’d adopted it because I was working with so many developers, who were all using the leaner and (some thought) meaner platform. It was built on the premise of openness, running counter to Internet Explorer (RIP) and the fast-growing Google Chrome.
Over time, though, it started to suffer from the same resource-hogging issues as Internet Explorer. I eventually gave it up and migrated to Chrome, then had a dalliance with Microsoft Edge and have now settled on Chrome on the desktop and Safari for mobile. If I’m being honest, I stopped considering Firefox years ago.
As the team took the makeshiift pitch and the stands filled with red shirts, I waited for Mozilla’s relatively new CEO Anthony Enzor-DeMeo and CMO John Solomon to arrive so I could quiz them about product plans and Mozilla’s dive into AI.
Enzor-DeMeo joined Mozilla in 2024 after stints at Roofstock, Better, and Wayfair. In each, the admitted nerd appears to have held positions relating to products, technology, and engineering. Solomon comes to Mozilla from Apple and Beats.
When Enzor-DeMeo finally does arrive, he looks younger than I expected and has a sort of nervous energy. It’s been a busy few days with a lot of interviews, and when I try to ask about Mozilla and AI, he tells me he doesn’t want to do any more. Still, he’s open and affable, explaining that he’s a die-hard It’s Always Sunny in Philadelphia (Rob McElhenney is a series star) fan, so much so that when someone else says they love the show, he asks them to name their favorite episode and then, without waiting for an answer, tells us his.
Still, Enzor-DeMeo was not a closet fan of the beautiful game. Instead, Solomon, who comes from the much more culturally connected Beats brand, suggested this partnership. Enzor-DeMeo watched Reynold’s Welcome to Wrexham doc and thought, “Oh, this makes a lot of sense.”
I stared at him, wondering what he saw that I didn’t. Sure, a partnership with the Red Dragons, as Wrexham are also known (I even spotted their red dragon mascot wandering the pitch and hugging fans) makes some sense. You know, fire, dragons? And this would be Wrexham’s second tech sponsorship after TikTok, which was widely featured in early seasons of Welcome to Wrexham. Mozilla confirmed that as they film the new season, we will see the Firefox brand on display in some fashion.
I looked at Enzor-DeMeo, who was still enthusiastically talking about It’s Always Sunny in Philadelphia, and asked him, “What’s the throughline from Firefox to Wrexham?” Enzor-DeMeo smiled and quickly answered, “Underdog.”
The only thing that would’ve made the moment more perfect is if an announcer suddenly screamed, “Goooooaaaallll!” But I got it.
If you’ve never seen the documentary, Wrexham AFC was the disintegrating center of a hardscrabble town that, despite over 150 years of footballing history, had been largely forgotten and fallen to the fifth tier of the English league system. Achieving Premier League status, a feat they very nearly accomplished last season, seemed impossible. Until Reynolds and McElhenney arrived.
Sure, there are people unhappy with the way celebrity and money have throw off the balance of a well-worn system, but if you watch the doc, you know that it was never enough to throw money and fame at it. It’s a very human story with equal measures of failure and success.
Firefox is surely the underdog in the browser game. Built on its own Gecko browser engine, it stands apart from Google, Apple and Microsoft, which all have a profit motive in having you use their platforms. Mozilla’s parent organization is non-profit, and although the Mozilla Corp, under which Firefox lives, is for-profit, its revenues are used to fund the non-profit effort.
Like its competitors, Firefox has AI features, letting you access the AI chatbot of your choice in a sidebar, and using AI to help you organize tabs. It does, though, seem a bit less interested in force-feeding AI.
Still, underdog status is no guarantee of a Cinderella story, and as the game drags on with countless missed shots and a handful of fouls, I wonder if Wrexham can embarrass Liverpool in front of its US fans. A moment later, Liverpool manages at roughly 60 minutes in to sail one over the outstretched arms of Wrexham substitute goalkeeper Callum Burton.
There’s no victory for the underdog this time, but it’s the pre-season, and Wrexham and its new sponsor Firefox should have many more chances to win on the pitch.
As businesses and governments turn to AI agents to access the internet and perform higher-level tasks, researchers continue to find serious flaws in large language models that can be exploited by bad actors.
The latest discovery comes from browser security firm LayerX, involving a bug in the Chrome extension for Anthropic’s Claude AI model that allows any other plugin – even ones without special permissions – to embed hidden instructions that can take over the agent.
“The flaw stems from an instruction in the extension’s code that allows any script running in the origin browser to communicate with Claude’s LLM, but does not verify who is running the script,” wrote LayerX senior researcher Aviad Gispan. “As a result, any extension can invoke a content script (which does not require any special permissions) and issue commands to the Claude extension.”
Gispan said he was able to execute any prompt he wanted, blow through Claude’s safety guardrails, evade user confirmation and perform cross-site actions across multiple Google tools. As a proof of concept, LayerX was able to exploit the flaw to extract files from Google Drive folders and share them with unauthorized parties, surveil recent email activity and send emails on behalf of a user, and pilfer private source code from a connected GitHub repository.
The vulnerability “effectively breaks Chrome’s extension security” by creating “a privilege escalation primitive across extensions, something Chrome’s security model is explicitly designed to prevent,” Gispan wrote.
Claude relies on text, user interface semantics, and interpretation of screenshots to make decisions, all things that an attacker can control on the input side. The researchers modified Claude’s user interface to remove labels and indicators around sensitive information, like passwords and sharing feedback, then prompted Claude to share the files with an outside server.
That means cybersecurity defenders often have nothing obviously malicious to detect. Where there is visible activity, the model can be prompted to cover its tracks by deleting emails and other evidence of its actions.
Ax Sharma, Head of Research at Manifold Security, called the vulnerability “a useful demonstration of why monitoring AI agents at the prompt layer is fundamentally insufficient.”
“The most sophisticated part of this attack isn’t the injection, but that the agent’s perceived environment was manipulated to produce actions that looked legitimate from the inside,” said Sharma. “That’s the class of threat the industry needs to be building defenses for.”
Gispan said LayerX reported the flaw to Anthropic on April 27, but claimed the company only issued a “partial” fix to the problem. According to LayerX, Anthropic responded a day later to say that the bug was a duplicate of another vulnerability already being addressed in a future update.
While that fix, issued May 6, introduced new approval flows for privileged actions that made it harder to exploit the same flaw, Gispan said he was still able to take over Claude’s agent in some scenarios.
“Switching to ‘privileged’ mode, even without the user’s notification or consent, enabled circumventing these security checks and injecting prompts into the Claude extension, as before,” Gispan wrote.
Anthropic did not respond to a request for comment from CyberScoop on the research and mitigation efforts.
The post Flaw in Claude’s Chrome extension allowed ‘any’ other plugin to hijack victims’ AI appeared first on CyberScoop.
Brian King // Do you know what that browser plugin is doing? There’s a browser plugin for just about everything. You can find one to change the name of […]
The post Browser Plugin Oversharing appeared first on Black Hills Information Security, Inc..
Login