and these browsers are specifically not that… these browsers are intended to do things like categorise tabs, complete forms, etc automatically without your interaction

of course they’ll ask before they do things they consider destructive, but what they consider destructive and what a malicious actor can use are very different things

some of that is certainly benign, but the point with prompt injection is that it can take benign things and make them plausibly malicious