1 Key Risks
The most critical security risks an operator inherits when deploying this agent in its documented default configuration. The default configuration exposes the operator's authenticated browsing session to AI-driven navigation with demonstrated prompt injection on the input path and no documented output filtering or structured monitoring.
2 AIRQ Scores
The four headline scores quantify how exposed the agent is, how damaging a successful attack would be, and how much the agent’s own controls reduce that risk. Opera Neon presents a moderate overall risk driven by demonstrated prompt injection on the input path partially offset by contained blast radius and partial vendor controls.
Opera Neon lands in the Fortified Leaders quadrant with Attack Surface 5.30, Blast Radius 4.75, and Defense Controls 7, reflecting elevated input exposure paired with contained downstream reach.
Each metric is scored against its axis maximum: Attack Surface and Blast Radius out of 10, Defense Controls out of 15, and AIRQ as a composite of all three.
| Metric | Score | Comments |
|---|---|---|
| AIRQ Score | 4.75 | Moderate composite reflecting demonstrated exploitation partially offset by contained blast radius and documented execution isolation. |
| Blast Radius | 4.75 / 10 | Contained primarily to outbound network access within the browsing session, with no default file system write or deployment infrastructure exposure. |
| Attack Surface | 5.3 / 10 | Elevated by demonstrated prompt injection on external data ingestion and model-agnostic reasoning delegation, with trifecta-complete floor applied. |
| Defense Controls | 7 / 15 | Partial controls from Chromium sandbox and action visibility, with input filtering and output monitoring remaining operator-managed. |
3 Attack Surface
Attack surfaces are the entry points and interaction patterns through which adversarial input can reach the agent’s reasoning loop and steer its behavior. The agent's reasoning loop ingests untrusted web page content, typed prompts, and MCP messages while delegating inference to interchangeable external models across a model-agnostic backend architecture.
Higher scores indicate surfaces where attacker-controlled input reaches the reasoning loop with fewer validated boundaries, peaking on external data and output processing where exploitation was demonstrated.
Each row scores one entry point or interaction pattern through which adversarial input can reach and steer the agent's behavior on the default configuration.
| Surface | Score | Comments |
|---|---|---|
| User Input | 3 / 4 | Accepts typed prompts and full page DOM context via the browser chat interface; a first-party prompt injection advisory exists following independent research that demonstrated hidden-HTML injection reaching the reasoning loop [1][2]. |
| External Data | 4 / 4 | Ingests untrusted web page content from any browsed domain without ML-based injection filtering; independently demonstrated indirect prompt injection via hidden HTML confirms active exploitation of this surface [1]. |
| Memory | 2 / 4 | Task-based workspaces isolate sessions with server-side retention and local history; the architecture contains no cross-session learning loop that could accumulate poisoned context over time [5]. |
| Reasoning | 3 / 4 | Model-agnostic architecture delegates reasoning to interchangeable external LLMs selected per task type, without exposing model-selection logic or chain-of-thought boundaries to the operator [3][7]. |
| Planning | 2 / 4 | Multi-step task planning operates within declared workspace scope with visible execution sequence; the operator can pause at any point during plan execution [7]. |
| Tool Execution | 2 / 4 | Browser automation tools execute within the Chromium sandbox; MCP write tools for navigation and form filling are disabled by default and require explicit opt-in before activation [6][8]. |
| Orchestration | 3 / 4 | Spawns autonomous AI agents in isolated cloud VMs that work asynchronously without per-call operator approval; the trust boundary between browser client and cloud agents is implicit rather than enforced by mutual authentication [7][4]. |
| Inter-Agent | 2 / 4 | MCP Connector allows external AI clients to control the browser session but is disabled by default; when enabled, messages from peer agents are processed with the same trust as operator messages [6]. |
| Output Processing | 3 / 4 | Agent navigation reaches any internet destination as output action; penalty applied for demonstrated exfiltration to an attacker-controlled server via the outbound navigation capability [1]. |
| Configuration | 2 / 4 | Default configuration reduces inter-agent exposure by disabling MCP write tools and limits financial-site blast by blacklisting sensitive domains; operator toggles control the boundary width [5][8]. |
The Lethal Trifecta is triggered when an agent processes untrusted content, accesses private data, and communicates externally in the same session — the three conditions that turn an isolated prompt injection into full-chain exfiltration. Opera Neon reads untrusted web page content into its reasoning loop, accesses data within the operator's authenticated browser session, and navigates outbound to any internet destination on the default configuration.
Opera Neon exhibits all three of these conditions in its documented default configuration:
- Untrusted input — Web page DOM content from any browsed website enters the AI reasoning loop as context, confirmed exploitable via hidden HTML injection [1].
- Sensitive data — The agent operates within the operator's authenticated session, accessing content on pages where the operator is logged in including email and financial services [5].
- External egress — Outbound HTTP navigation to any domain is core functionality, with demonstrated exfiltration of extracted data to a third-party server [1].
4 Blast Radius
The blast radius is what an attacker who controls the agent can reach — which systems they touch, which credentials they read, and which actions they take without operator approval. A compromised session reaches the operator's browsing context and outbound network but stops short of file system writes, deployment infrastructure, or credential extraction from the device.
Higher blast scores indicate factors where a successful exploitation grants the attacker broader reach, peaking on unrestricted outbound network access.
Each row maps a blast factor to the scope of damage an attacker achieves when the agent's reasoning loop is subverted on the default configuration.
| Factor | Score | Comments |
|---|---|---|
| Code execution | 2 / 4 | Even if the agent's reasoning is subverted, code execution remains sandboxed to the browser process or a disposable cloud VM with no path to the operator's host [7]. |
| File system access | 1 / 4 | No documented file system write capability beyond standard browser downloads requiring user confirmation; cloud VM artifacts are delivered as URLs rather than local files [9]. |
| Network access | 3 / 4 | Core Neon Do navigation reaches any internet domain without restriction as default functionality; operator-configurable blacklist covers only a narrow set of financial destinations [6]. |
| Credential access | 2 / 4 | Operates within the authenticated browser session accessing any page where the operator is logged in; credentials stay on-device and are not transmitted to the AI engine [5]. |
| Autonomous action | 2 / 4 | Neon Do executes multi-step navigation autonomously within a visible session; Neon Make spawns background agents that continue when the browser is closed [7]. |
| Deployment access | 1 / 4 | No documented access to operator cloud infrastructure, IaC pipelines, or production deployment targets; scope is limited to browser session and creative output URLs [9]. |
5 Defense Controls
Defense controls are what the agent’s own architecture does to detect, contain, and report attacks before they reach the operator’s systems. The vendor documents Chromium sandboxing and real-time action visibility as defaults, while input injection filtering and output exfiltration monitoring remain absent or operator-managed.
Higher defense scores indicate stronger vendor-implemented safeguards on the default configuration, with the inverted color scale showing where operator hardening is most needed.
Each component scores what the vendor implements by default versus what remains the operator's responsibility to configure or deploy externally.
| Component | Score | Comments |
|---|---|---|
| Input Guardrails | 1 / 3 | Post-disclosure fix separates user prompts from page content; no documented ML-based injection classifier or prompt shield; ongoing penetration testing mentioned without published results [2][3]. |
| Execution Isolation | 2 / 3 | Chromium multi-process sandbox enforced by default; Task-based workspace isolation prevents cross-Task access; cloud VM agents run on isolated European servers [3][7]. |
| Action Controls | 2 / 3 | Operator pause and domain blacklisting gate high-risk destinations, but the absence of per-action confirmation on non-blacklisted navigation prevents granular approval gates [5][6]. |
| Output Guardrails | 1 / 3 | The navigation output path lacks any filtering layer between the agent's intent and the external destination, leaving exfiltration via outbound requests undetectable by the agent itself [5]. |
| Monitoring | 1 / 3 | Activity retained with auto-deletion; operator can review in chat window; no structured audit log, SIEM forwarding, or anomaly detection capability documented [5]. |
6 Hardening Tips
Concrete actions an operator can take to reduce the risks reported above, grouped by which defense control each tip strengthens. Operators should prioritize breaking the trifecta chain by deploying input injection filtering and outbound navigation monitoring before enabling agentic features on enterprise networks.
Input Guardrails
Input guardrails intercept adversarial content before it reaches the reasoning loop.
- Policy Require deployment of a prompt injection classifier on the DOM content pipeline before enabling browser automation on enterprise networks.
- Configuration Restrict browsing to an allowlisted set of internal domains via network policy rather than relying on the default open-internet configuration.
- Engineering Wire a content-security-policy equivalent that strips hidden or zero-opacity elements from DOM content before AI ingestion.
Execution Isolation
Execution isolation contains what a compromised agent can do on the host.
- Policy Establish a policy requiring agentic browsing within a dedicated browser profile isolated from the operator's primary authenticated session.
- Configuration Configure cloud tasks to use operator-managed infrastructure with network egress controls rather than the default shared servers.
- Engineering Deploy a browser-level sandbox monitor that logs all cross-origin navigations initiated by the AI agent for post-hoc audit.
Action Controls
Action controls govern which tools and actions the agent can invoke autonomously.
- Policy Mandate per-action confirmation for navigation to external domains not on an operator-maintained allowlist.
- Configuration Extend the default financial-site blacklist to cover all sensitive enterprise applications and internal portals.
- Engineering Integrate a URL reputation service that blocks navigation to domains with low trust scores or recent registration dates.
Output Guardrails
Output guardrails inspect what the agent sends to other systems and users.
- Policy Deploy outbound request monitoring that flags navigation to newly registered domains or destinations outside the operator's browsing history.
- Configuration Configure network-level DLP inspection on all outbound requests initiated by the browser automation agent process.
- Engineering Instrument the output path with URL sanitization that detects and blocks requests carrying sensitive tokens in query parameters.
Monitoring
Monitoring captures what the agent did and surfaces anomalies for review.
- Policy Require forwarding of all browser automation and cloud task activity logs to the operator's SIEM before enabling agentic features.
- Configuration Enable verbose logging of all MCP Connector interactions including tool invocations, authentication events, and session changes.
- Engineering Deploy anomaly detection on agent navigation patterns that alerts on visits to domains outside normal operating scope.
7 References
The evidence base behind every score and finding in the profile, grouped by source type so the reader can verify any claim. Numbers in brackets throughout the report (e.g. [7, 13]) refer to entries below, listed in citation order.
Selected Vulnerabilities
- Prompt injection flaw in Opera Neon Brave Research demonstrated indirect prompt injection via hidden HTML allowing cross-origin data exfiltration from authenticated pages. Patched October 2025.
- Opera Neon prompt injection rapid response Opera vendor disclosure confirming prompt injection vulnerability with 10% reproduction rate and same-day fix deployment.
Selected Research
- Understanding agentic browser security Opera Security team threat model for agentic browsers covering data leakage, prompt injection, and action manipulation risks.
- Opera Neon and the Dawn of the Agentic Browser Runtime AgentsDB independent analysis of Opera Neon discussing sandboxing, least privilege, and security boundaries.
Vendor Documentation
- Opera Neon AI FAQ Vendor FAQ documenting Neon Chat, Neon Do, Neon Make capabilities plus privacy controls and data retention policy.
- Opera Neon MCP Connector MCP Connector exposing the browser as an MCP server for external AI clients with write tools for navigation and form filling.
- Opera Neon agentic browser release Product launch describing Neon Do browser automation, Neon Make cloud VM agents, and Task-based workspace isolation.
Other Sources
- Opera Neon MCP Connector security coverage Independent coverage noting missing permission documentation for MCP Connector write tools.
- Opera Neon product page Official product page describing browser automation, task management, and AI-driven workflow capabilities.