CLAIM-2026-08-04-04

Google's agentic browsing security post of 8 December 2025 states that when signing into sites via Google Password Manager "the model does not have direct access to stored passwords", that indirect prompt injection is "the primary new threat facing all agentic browsers", and that the agent will "try to pause and either get permission from the user" before purchases, payments or other consequential actions.

Why it matters

It corrects the popular reading of the July feature. The credential itself is not exposed to the model; the risk that remains is the authenticated session and the hostile page, which are architecture problems rather than secret-handling problems.

Sources

google2025architect

CLAIM-2026-08-04-04

Google's agentic browsing security post of 8 December 2025 states that when signing into sites via Google Password Manager "the model does not have direct access to stored passwords", that indirect prompt injection is "the primary new threat facing all agentic browsers", and that the agent will "try to pause and either get permission from the user" before purchases, payments or other consequential actions.

Why it matters

Sources

google2025architect