The same-origin policy is a foundational browser security rule, introduced in 1995, that stops a website from reading data that belongs to another site — even when one site is embedded inside the other. It is what keeps an advertisement frame from reaching into your open email tab, and it is one of the protections most of the modern web quietly depends on.
The concept matters again in AI search because an agentic browser reads and acts on the live page for a user, which changes what the rule has to hold against. A 2026 University of Washington study of seven agentic browsers found that four of them let a malicious page bypass the same-origin policy, with a demonstrated data-theft attack against one (ChatGPT Atlas). The researchers' framing: in these browsers the protection effectively reduces to the strength of the agent's defenses against prompt injection — if a page can trick the agent with hidden instructions, it can push the agent across a boundary that used to be absolute (attributed and hedged as single-study, mid-2026 data; affected browsers will change as vendors patch).
For brands, the same-origin policy is distinct from answer poisoning, which seeds false content into the sources engines retrieve about you. This is on your own page, aimed at a visitor's agent during a live session. The practical implication is page hygiene: user-generated content, third-party embeds, and hidden text are where injected instructions live, so keeping them inert is now part of being safe for the agents that visit you.