Well, instead of one agent (the user) to phish there's two (both the user and the browser agent) and you only need to convince one.
If the human is much easier to phish than the agent (which I believe is true in most cases) then this would be a win
As Simon Wilison clearly laid out, 99% secure isn’t secure and you think you can fix it by adding mor/better prompts?
Which methods do you have planned outside of “better prompting/fine tuning”?