Prompt Forcing is a technique for steering an AI assistant by shaping the interaction flow, not just by hiding malicious instructions in text. Instead of relying on a single prompt-injection payload, the attacker influences what the assistant sees, when it sees it, and how it is expected to respond. In practice, this can involve page content, browser state, extension behavior, or UI steps that nudge the model toward a chosen path.
This matters because browser-based AI agents often have access to authenticated sessions, page content, and action privileges. If an attacker can control the flow of interaction, the assistant may summarize the wrong content, follow an unsafe workflow, or act on misleading context. Defenders should treat assistant behavior as a control plane issue: limit extension permissions, enforce origin-aware checks, require confirmation for sensitive actions, and avoid letting untrusted pages silently shape the agent’s next step.