China's cybersecurity standards committee has circulated a draft practice guide for AI browsers, with a list of operations that must not run without a second user confirmation

How the draft defines the product

An AI browser, on this text's definition, is a browser with a large model module added, integrating natural language interaction, automated task execution, cross-site information extraction and user behaviour proxying, able to make and execute some decisions autonomously once the user authorises it.

The note then splits the category three ways along axes of automation capability, where the model runs, and how deeply it is integrated: assisted, agentic, and lightweight on-device. Four further terms get their own definitions. User behaviour proxying is the browser performing clicks, form filling and cross-site navigation on the user's behalf. Cross-site data extraction is automatic retrieval and aggregation across sites. Prompt injection is an attacker embedding malicious instructions through page content, search keywords or hidden text to make the browser bypass a security policy, leak sensitive information or perform unauthorised operations. Agent privilege escalation is the browser executing operations without sufficient authorisation.

Five security attributes frame the document: confidentiality, credibility, availability, controllability and compliance. The controllability item carries the clause worth arguing about, which says that when performing user behaviour proxying the browser should indicate its AI identity to the website.

The risk taxonomy

Clause 6 sets out five risk families before any requirement appears. System function hijacking and control covers agent privilege escalation, role escalation and permission creep across multiple extensions or agents, browser kernel interaction flaws in dual-engine designs, denial of service through recursive or high-frequency self-calls, cross-site request forgery and tab injection, identity and session hijacking of stored tokens and passwords, and navigation target misjudgement.

That last one is described with unusual care. Where a user instruction is vague, the model may plan a route to a near-identical spoofed domain or a stale link, and because proxy operation is unobtrusive the user is unlikely to be checking the URL. The draft treats the loss of the user's habitual URL check as itself part of the risk.

The other four families are model adversarial attack, covering direct prompt injection, indirect injection through poisoned retrieval corpora, adversarial samples and multimodal attacks; model reliability and ethics, covering hallucinated page summaries and bias in personalised presentation; supply chain and ecosystem, naming open source model and toolchain backdoors, multi-agent collusion over protocols such as MCP and A2A, and fine-tuning data poisoning; and communication and transmission, covering unencrypted cross-component traffic and failure to force HTTPS.

Controls on the agent's hands

Clause 7.1 asks for a dynamically updatable high-risk operation list that the user is told about, so that any task plan containing such an action prompts for confirmation or handover. It then draws a line that many current products would fail: on pages where the user is logged in or where information is submitted, the browser should not perform operations that change the state of the user's submitted information in a way the user cannot perceive, and any operation that could change page or user state on a page touching user rights should be explicitly triggered rather than automatic.

The rest of the clause is boundary work. Interaction should be confined to elements the task needs, with alerting and blocking for operations plainly outside it. For financial and similar tasks, a navigation target that misses a high-reputation domain allowlist should be treated as potential misjudgement or spoofing, flagged clearly, and left to the user to confirm. Access frequency, concurrent requests and batch tasks should be rate limited, with automatic blocking of high-frequency behaviour against sensitive sites. Automated tasks should show progress and let the user stop at any time.

Against prompt injection, clause 7.2 asks for structural stripping and semantic cleaning of page input to remove invisible, hidden and disguised elements such as display:none, zero-width characters and CSS-offset text; separation of user instructions from page content; per-tab context isolation so cross-site prompt passing cannot occur; a consistency check terminating an operation that does not match the understood user intent; and a floor the user cannot talk the browser below, so that no natural language instruction redefines the system's core behavioural rules.

The high-risk operation list

Clause 7.6 a requires risk grading of the operations an AI browser can invoke, with anything graded high risk needing a second confirmation before execution. The note defines that as authorisation both when the AI function is switched on and again when the operation runs. Clause 7.6 b states the principle behind it: for the key operations the browser is allowed to invoke, the user should hold final control.

Annex A gives the list in five categories. Property operations covers transfers, wealth management, loans, stocks, funds, futures, gold and digital currency, payment operations including one-click and password-free payment and sending red packets, and transfers of tradable virtual assets such as game items and accounts. Protocol and authorisation operations covers consent, identity verification, agreement confirmation and seeking medical treatment or examination. High-sensitivity account operations covers account cancellation, password change and freezing.

The fourth category, high-risk system permissions, reaches past the browser: factory reset, emptying the recycle bin, permanent deletion, obtaining administrator privileges, and installing or uninstalling applications. The fifth is any invocation of a camera, fingerprint sensor or similar sensor collecting sensitive personal information. Clause 7.6 c adds that multimodal invocation should follow operating system permission rules with explicit authorisation and a stated collection scope, and that automatic continuous screenshotting or background audio and video monitoring should not happen without permission.

Supply chain, transport and memory

On supply chain, clause 7.4 has only two items but both bite. Extensions should not use unverified third-party models or fine-tuning datasets, models should preferably be ones filed with the state, all models should come from a trusted source and fine-tuning data should be audited. And an SBOM should be maintained for open source dependencies, with periodic vulnerability scanning, with LangChain given as the example.

Transport requirements ask for TLCP or TLS 1.3 or similar for all cross-component communication, including between the AI and local agent services and for cloud memory sync. Underlying components such as the browser kernel, DOM parser and dual-engine compatibility layer should get security and fuzz testing. Local cache including screenshots, OCR text and intermediate results should be transmitted encrypted, and should not be written to the user's file system without authorisation. Sensitive credentials such as tokens and cookies should not be provided to third parties beyond what the service requires or the user has permitted.

Long-term memory is treated as a distinct exposure. Clause 7.7 asks that users be able to view, delete and modify long-term memory, with the note defining it as information persisted across tasks and sessions that does not disappear when a particular task does, and asks for device-level key encryption of local memory so other applications cannot read it. Generated content gets labelled under GB 45438-2025, and users are to be told the model's capability boundaries in plain language.

What we did not verify

We opened the TC260 notice page dated 29 July 2026 and downloaded and read the full draft PDF of the AI browser guide, including Annex A. Clause numbers, definitions, the drafting bodies and the version string v1.1-202607 come from that document.

We did not read Annex B, the examples annex, in full, and we do not quote from it. We did not open GB 45438-2025, GB/T 45654-2025 or the generative AI service management interim measures that the abstract cites, so we report only how this draft refers to them.

We do not claim this guide will be published, published in this form, or given legal effect, and we do not claim that any browser currently on sale in China does or does not meet it. We tested nothing.

Related briefings

• China: TC260 AI agent deployment security guide
• China: TC260 sector AI application security guides
• Asia Pacific AI regulation hub
• For executives
• AI Regulation News hub