A new class of AI agent has entered production, and these agents do not interact with the world through the structured tool calls and function calls that most threat models assume. They are called vision-and-action agents, for example, Anthropic's computer-use capability, OpenAI's Operator, and several open-source browser-driving projects. They operate the rendered interface directly and interact through the screen, the DOM, clicks, and keystrokes inside the user's own authenticated session.
This places a new actor inside the trust boundary and creates a direct collision with classical web security. Indeed, a clickjacking overlay fools a vision-driven agent the same way it fools a human user. The perception layer of these agents (pixels for some systems, the DOM for others) introduces an attack surface that most security teams have not yet modeled.
In this talk, I will apply the OWASP Agentic Security Initiative (ASI) Top 10 as a threat map for this agent subclass. Some ASI categories apply without modification, whereas others change character entirely. For instance, ASI01 Goal Hijacking expands from poisoned documents to any content the agent renders on screen; ASI02 Tool Misuse manifests as unintended clicks and form submissions in an authenticated session where no tool-permission layer exists to constrain them, and ASI03 Identity and Privilege Abuse changes character when the agent holds the human's live session and every downstream system treats the agent's actions as indistinguishable from the human's.
I will map each relevant ASI category to its vision-and-action equivalent and draw on concrete failure modes from publicly documented systems and published research on indirect prompt injection against agentic browsers. Attendees will leave with a design-time threat-modeling worksheet applicable to any browser-driving agent, whether they are building one, buying one, or defending the environment one is about to enter.