“A prompt injection attack on an AI browser's agent mode could potentially cause the agent to access and leak a user's private information, for example by opening their Gmail.”