Indirect prompt injection vulnerability in AI browsers