Phase 0: Long-Horizon Autonomy · ~45 minutes · Python (stdlib · indirect prompt-injection attack surface model)

Browser Agents and Long-Horizon Web Tasks

ChatGPT agent (July 2025) merged Operator and deep research into one browser/terminal agent and set BrowseComp SOTA at 68.9%.

Hiring signal: Can operate browser agents and long-horizon web tasks in production

Introduction

OpenAI shut Operator down August 31, 2025 — consolidation at the product layer. Anthropic's Vercept acquisition moved Claude Sonnet on OSWorld from under 15% to 72.5%. WebArena-Verified (ServiceNow, ICLR 2026) fixed 11.3 percentage points of false-negative rate in the original WebArena and shipped the 258-task Hard subset. The numbers are real. So is the attack surface: OpenAI's head of preparedness stated publicly that indirect prompt injection into browser agents "is not a bug that can be fully patched." Documented 2025–2026 attacks: Tainted Memories (Atlas CSRF), HashJack (Cato Networks), and one-click hijacks in Perplexity Comet.

Type: Learn Languages: Python (stdlib, indirect prompt-injection attack surface model) Prerequisites: Phase 15 · 10 (Permission modes), Phase 15 · 01 (Long-horizon agents) Time: ~45 minutes

Objective

Learning objectives

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The Problem, The Concept, Build, Check Yourself, Key Terms & Next — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.