How Minda handles prompt injection

What is prompt injection?

Text in a page, a file or a message that an AI agent reads and takes as an order from you.

Brave hid instructions in a Reddit comment. When the user asked Perplexity's Comet to summarize the page, Comet opened the user's account page, took their email address, read a one-time password in Gmail and posted both back as a reply, with no further input from the user. An agent that acts with your sign-ins can be steered that way into something you never asked for.

Does Minda keep your instructions apart from page content?

Yes: page text reaches the model fenced as data, never as your instructions.

The browser should clearly separate the user's instructions from the website's contents when sending them as context to the backend. The contents of the page should always be treated as untrusted.

Brave

• Everything a website supplies (page text, titles, search results, the labels of buttons and fields) reaches the model inside a block marked untrusted, and the model is told that only you give instructions. Hidden characters are stripped and look-alike tags are filtered, so a page cannot close the block early.
• Files, saved pages, mail, calendar invitations, Notion pages and the event an automation hands to an agent are fenced as data too.
• A task held to some sites is told which sites they are, and that a page asking it to go elsewhere or send data is the page, not you.

What it does not do: A fence tells the model what is data; it cannot make a model obey. That is why the safeguards below do not rely on the model. What the AI remembers about you is not fenced, because your preferences must work as instructions.

Are the agent's actions checked against what you asked?

Not step by step by a second model. Minda checks some things in its own code, and Careful adds your OK to the steps that matter.

Based upon the task and the context, the model comes up with actions for the browser to take; these actions should be treated as 'potentially unsafe' and should be independently checked for alignment against the user's requests.

Brave

• Auto is on by default: clicks, typed text, key presses and form fills run without asking, in chats, tasks and schedules alike.
• Careful (Settings, AI agent, Access, or the Modes menu in the chat box; off by default) makes a step that sends, posts, deletes, uploads, types a password or gives access wait for your OK, and an address the model put together from what it read too. A team admin can require it for every member.
• A site you block in Settings, AI agent, Access is refused before a page loads or is read.
• Double-check finished work (Settings, AI, Agent models; off until you pick a model) has a second model read a run's work record against your request once, before the run ends. It reviews the outcome; it does not stop a step before it runs.

What it does not do: With Careful off, Minda does not check each action against your request. Within the sites it may use, a page that steers the model can make it click, type or fill a form, and an address the model builds from what it read opens without asking.

Do sensitive actions need you?

Some always do, and Careful adds more. These wait for your OK each time:

No matter the prior agent plan and tasks, the model should require explicit user interaction for security and privacy-sensitive tasks.

Brave

• A step that pays, buys or places an order, while Ask before paying is on. It is on by default; you can turn it off in Settings, AI agent, Access.
• Looking at your screen or at another program's window, every time. It never happens in a background task or a schedule.
• Mail to an address you did not write waits for your Send in a chat; a background run saves a draft instead.
• With Careful on: sending, posting, deleting, uploading, typing a password and giving access.

A background task that reaches one of these waits for you in Tasks.

What it does not do: With Careful off, typing a password or a code, sending a message on a site and deleting run on their own. Ask before paying matches what a page calls a button or field, so a payment button a page labels only "Continue" can slip past it.

Is the agent kept apart from your regular browsing?

Partly: it acts only when you ask, and a task can be held to the sites you name.

Agentic browsing is an inherently powerful-but-risky mode for the user to be in, as this attack demonstrates. It should be impossible for the user to 'accidentally' end up in this mode while casually browsing.

Brave

• The agent acts only on a request: a chat message you send, a task or schedule you start, an automation rule you made (whose agent only reads), or a coding agent you connect through the developer bridge, which is off by default.
• A background task or a schedule can be held to Only these sites. Minda refuses the task's pages any other site before a request leaves: opening it, a link or form to it, a redirect and a pop-up.
• A background task runs in off-screen pages of one workspace, with that workspace's sign-ins only. A chat works in the workspace on screen, in one your own words name or, with Auto on, in any of them.

What it does not do: The SI agent works in Minda's built-in browser with your sign-ins, and a chat is not held to sites: block a site to keep the agent off it. A site scope covers the task's own pages, not the images, scripts and frames a page loads, so it limits what the agent opens and reads; it is not a network firewall.

What did Minda's own test show?

With a site scope on, a hostile page reached the attacker's server 0 times.

On 27 September 2026 Minda ran a production build against a scripted model that obeys whatever a page says, a test site the task was held to, and an "attacker" server on the same computer that counted every request.

• Told by the hostile page to open, go to or read the attacker's address in the background, the agent was refused each time, before a request left.
• A form on the test site that submitted to the attacker was refused too: 0 requests.
• Without a site scope, the attacker's server got the page request.

The site scope is checked in Minda's own code, so it holds whether or not a step asks. This is Minda's own test with a scripted model, not an outside audit.

What is not covered?

• With Careful off, most steps run on their own: keep the agent off sites you would not trust it with, hold tasks to the sites they need, or turn Careful on.
• What the AI remembers is not fenced. Settings, AI lists each memory for deletion.
• Mail, calendar invitations and shared Notion pages carry other people's words. They are fenced, but they still reach the model you use.
• Minda has no third-party security audit or certification yet.

The privacy audit lists every known gap.

Sources

• Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet, Brave (Artem Chaikin and Shivan Kaul Sahib), 20 August 2025, read 18 October 2026
• What leaves your computer, Minda's privacy audit: the SI agent's rows and the known gaps

Brave, Perplexity and Comet are trademarks of their owners. Minda is not affiliated with or endorsed by them.