Scope boundary

Owns task- or trust-zone isolation of browser-managed state and disposable desktop computer-use workspaces, including contexts, profiles, origins, cookies, local storage, IndexedDB, cache, history, downloads, clipboard, screenshots, desktop-session state, and automation permissions.

AID-I-007: AID-I-008 isolates browser-managed and desktop-workspace state around an agent task; AID-I-007 confines the client-side model or model-runtime component itself. A sandboxed model component does not rotate authenticated browser state, and a fresh browser context does not prove that the embedded model runtime has a minimal capability boundary.

AID-H-019: AID-I-008 isolates browser and desktop state after content is admitted to a computer-use workflow; AID-H-019 owns URL admission, safe fetch, content demotion, observation export, and the outer browser process boundary. Safe content handling does not replace per-task state isolation, and an isolated workspace does not make an untrusted URL or observation safe.

AID-I-001.003: AID-I-008 owns browser-context and desktop-workspace state lifecycle; AID-I-001.003 owns the enclosing single-use sandbox lifecycle and teardown. A fresh browser profile can run inside a reused process sandbox, and a fresh process sandbox can still inherit browser-managed state unless both controls are enforced.

AID-I-004: AID-I-008 isolates browser and desktop automation state; AID-I-004 isolates conversational context, tool traces, peer messages, and persistent agent memory. Browser storage or clipboard cleanup does not prove model-context hygiene, and clearing agent memory does not remove cookies, downloads, desktop files, or authenticated browser residue.

Sub-techniques

• AID-I-008.001: Ephemeral Browser Context Lifecycle & Storage Partitioning
• AID-I-008.002: Cross-Origin Read/Write Segmentation with Step-Up Confirmation
• AID-I-008.003: Download & Clipboard Transfer Quarantine
• AID-I-008.004: Desktop Computer-Use Workspace Isolation & Action Confirmation
• AID-I-008.005: Magic-Link & Authentication-Bearing Navigation Isolation

Threat mappings

MITRE ATLAS

• AML.T0011.003 User Execution: Malicious Link
• AML.T0051.001 LLM Prompt Injection: Indirect
• AML.T0053 AI Agent Tool Invocation
• AML.T0086 Exfiltration via AI Agent Tool Invocation
• AML.T0089 Enterprise Environment Discovery
• AML.T0091.001 Use Alternate Authentication Material: Web Session Cookie
• AML.T0100 AI Agent Clickbait
• AML.T0101 Data Destruction via AI Agent Tool Invocation
• AML.T0112 Machine Compromise
• AML.T0112.000 Machine Compromise: Local AI Agent
• AML.T0113 Steal Web Session Cookie

MAESTRO

• Data Exfiltration (L2)
• Compromised Agents (L7)
• Agent Tool Misuse (L7)
• Integration Risks (L7)

OWASP LLM Top 10 2026

• LLM01:2026 Prompt Injection
• LLM02:2026 Sensitive Information Disclosure
• LLM03:2026 Excessive Agency
• LLM07:2026 Misinformation
• LLM10:2026 Improper Output Handling

OWASP ML Top 10 2023

• N/A

OWASP Top 10 for Agentic Applications 2026

• ASI01:2026 Agent Goal Hijack
• ASI02:2026 Tool Misuse and Exploitation
• ASI03:2026 Identity and Privilege Abuse
• ASI05:2026 Unexpected Code Execution (RCE)
• ASI09:2026 Human-Agent Trust Exploitation

NIST Adversarial Machine Learning 2025

• NISTAML.015 Indirect Prompt Injection
• NISTAML.036 Leaking information from user interactions
• NISTAML.039 Compromising connected resources

Cisco Integrated AI Security and Safety Framework

• AITech-1.2 Indirect Prompt Injection
• AITech-1.3 Multimodal Injection and Manipulation
• AITech-2.1 Excessive Agency
• AITech-4.2 Context Boundary Attacks
• AITech-8.2 Data Exfiltration / Exposure
• AITech-8.3 Information Disclosure
• AITech-9.1 Model or Agentic System Manipulation
• AITech-12.1 Tool Exploitation
• AITech-14.1 Unauthorized Access
• AITech-14.2 Abuse of Delegated Authority
• AISubtech-1.3.1 Image-Text Injection
• AISubtech-2.1.1 Execution Approval Bypass
• AISubtech-2.1.2 Capability and Permission Overreach
• AISubtech-4.2.2 Session Boundary Violation
• AISubtech-4.3.4 Replay Exploitation
• AISubtech-4.3.6 Cross-Origin Exploitation
• AISubtech-8.2.3 Data Exfiltration via Agent Tooling
• AISubtech-9.1.2 Unauthorized or Unsolicited System Access
• AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
• AISubtech-12.1.3 Unsafe System / Browser / File Execution
• AISubtech-14.1.1 Credential Theft
• AISubtech-14.1.2 Insufficient Access Controls

Google Secure AI Framework 2.0 - Risks

• IIC: Insecure Integrated Component
• PIJ: Prompt Injection
• SDD: Sensitive Data Disclosure
• RA: Rogue Actions

Databricks AI Security Framework 3.0

• Agents - Core 13.2: Tool Misuse
• Agents - Core 13.3: Privilege Compromise
• Agents - Core 13.6: Intent Breaking & Goal Manipulation
• Agents - Core 13.11: Unexpected RCE and Code Attacks
• Agents - Tools MCP Client 13.28: UI/UX Deception
• Agents - Tools MCP Client 13.30: Client-Side Data Leakage
• Agents - Tools MCP Client 13.34: Session and State Management Failures