Well, instead of one agent (the user) to phish there's two (both the user and the browser agent) and you only need to convince one.

I claim that is not true, because very soon AI agents (probably built into Chrome) will detect and warn. In which case you need to phish the agent, tricking the human won't be enough.

If the human is much easier to phish than the agent (which I believe is true in most cases) then this would be a win

Yet, you add another attack vector, something that is very willing to do stuff, as long as you prompt it right…

As Simon Wilison clearly laid out, 99% secure isn’t secure and you think you can fix it by adding mor/better prompts?

Which methods do you have planned outside of “better prompting/fine tuning”?