Why it matters
A systematic study of server-side browsers used by AI search and web-browsing services reports remote-code-execution paths in six leading services with a combined user base above one billion. The work covers domain-allowlist bypasses, JavaScript-restriction evasion, remote browser fingerprinting, service disruption, output manipulation, and server compromise.
My takeaway: Model backend browsers as shared, privileged internet clients. Isolate them per request, minimize network and filesystem reach, keep browser builds independently inventoried and patched, test allowlists against redirects and parser differences, and assume attacker-controlled pages will target both the model and the browser runtime.