Refusal-Trained LLMs Are Easily Jailbroken As Browser Agents