Prompt Injection and Data Theft Risks Emerge In Agentic LLM Browsers