Lack of isolation in agentic browsers resurfaces old vulnerabilities