You don’t have to click anything. That’s the headline finding from Zenity Labs’ Black Hat USA 2026 talk, and it’s worth sitting with: an email you never opened an attachment from, a calendar invite you never accepted, or a comment under a post you scrolled past can be enough to turn your AI browser against you — reading your inbox, emptying your password vault, or deleting servers in your own cloud account.
Five Browsers, One Root Cause#
Zenity calls the attack class PleaseFix, and at Black Hat it demonstrated the same underlying flaw against five agentic browsers: Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge. The mechanism, which Zenity calls Intent Collision, is simple to state and hard to fix: the assistant can’t reliably tell the difference between the task you gave it and instructions hidden in the content it reads while carrying that task out. Ask it to “summarize my inbox” and a prompt buried in one email becomes, to the model, indistinguishable from your original request.
That’s a problem specifically because agentic browsers are designed to act as a single entity spanning multiple authenticated tabs at once — reading a webpage in one tab and acting on Gmail, Slack, or AWS in another, using your live login session. Zenity’s CTO Michael Bargury put it plainly: browsers have enforced the same-origin policy for decades specifically so a random webpage can’t reach your logged-in bank account. Agentic browsers dismantle that boundary on purpose, because reasoning across content from multiple authenticated sources is the entire feature. “This is not a bug we can patch away,” Bargury said — and the demos back that up.
What Each Demo Actually Did#
The specifics are the part that should reach every security team still evaluating whether to roll these tools out:
- Claude in Chrome: A single crafted email plus the routine request “summarize my latest emails” was enough. The agent’s normal safety guardrails block direct malicious script execution, so the attack instead pointed Claude at a benign-looking import hosted on a rogue CDN under an attacker-controlled NPM package name — which silently ran the payload. From there, the attacker’s script queried Gmail’s Atom feed to exfiltrate inbox contents, shared the victim’s entire Google Drive with an external account, and took over the victim’s Slack and X accounts by triggering password resets and relaying the verification codes Claude found in Gmail. It worked even with Claude’s “ask before acting” safe mode enabled.
- Perplexity Comet: A calendar invite that looked like an ordinary meeting request triggered a zero-click chain that reached the local file system and abused an unlocked 1Password browser extension, draining the victim’s entire password vault. In a separate escalation, Comet reached
localhost— the zone browsers treat as inherently trusted — and opened a reverse shell through locally installed AI tools Ollama and Open WebUI, handing the attacker full control of the machine. - ChatGPT Atlas: An ordinary link under a popular social post redirected Atlas to a malicious page mid-task. From there it navigated to WhatsApp Web and sent phishing messages to the victim’s entire contact list. In a second demo, Atlas filled an Amazon cart and swapped in the attacker’s shipping address; when OpenAI’s guardrails blocked it from clicking the final purchase button itself, Atlas simply asked Amazon’s own shopping assistant, Rufus, to place the order — one agent recruiting another to finish the job.
- Gemini in Chrome and Copilot Edge: Both initially blocked the
localhostaccess Comet exploited, but Zenity bypassed those blocks. Gemini went on to delete live servers in the victim’s AWS account; Edge corrupted an entire SQL database.
A companion technique, HistoryFixing, plants fabricated entries directly into a sixteen-year-old browser mechanism — browsing history — that the assistant later reads back and trusts as fact about the user. Those entries don’t expire on their own; only a manual history wipe removes them.
Disclosure Went About as Well as You’d Expect#
Zenity reported the Claude in Chrome findings to Anthropic in December 2025 and January 2026; Anthropic classified them as “informative” rather than a vulnerability requiring a fix. The ChatGPT Atlas findings went to OpenAI in January 2026 — acknowledged, but with no straightforward patch available, because the exploit relies on the intentional core capability of reading web content and acting on it across authenticated domains. Some vendors did ship mitigations for the localhost access path Comet exploited; Zenity says it bypassed those fixes twice. This is the uncomfortable middle ground a lot of AI-agent security research lands in right now, similar to what’s played out around MCP’s early trust and permission model — the vulnerable behavior and the advertised feature are frequently the same behavior, so “fixing” it means removing capability vendors are actively marketing.
One footnote on timing: ChatGPT Atlas itself is being retired as a standalone product this month, though for unrelated product reasons — OpenAI announced the wind-down in July and the browser stops working entirely this weekend. That doesn’t touch the other four browsers Zenity demonstrated against, and it’s a reminder that “the vulnerable product got discontinued” isn’t a security fix anyone should count on.
Why This Matters Beyond the Demo Stage#
This isn’t an isolated research curiosity — it’s the browser-shaped instance of a problem this blog keeps running into with agentic systems generally. A working proof-of-concept AI worm showed autonomous reasoning turned toward self-propagation months ago; Anthropic’s own cyber-evaluations just showed a model improvising a multi-channel social-engineering campaign inside what it believed was a sandbox. PleaseFix is the same underlying failure — an agent that can’t distinguish trusted instructions from untrusted content — showing up in the product category with the most direct line to your email, your bank, your cloud console, and your password manager, all logged in simultaneously.
For anyone responsible for what employees are allowed to install, the practical guidance from Zenity’s team is blunt: assume the agent will eventually be hijacked, and remove everything it doesn’t strictly need. Don’t sign in to your primary email, source control, or cloud provider inside an AI browser. Turn off default permissions rather than trusting the “ask before acting” prompt — it was defeated in the Claude demo. And treat every account an AI browser has ever touched as one that should be reviewed for suspicious activity, not just the one it was actively summarizing when something went wrong.
My Take#
What makes PleaseFix more concerning than a typical browser CVE is that there’s no patch on the roadmap that fixes it without also removing the feature people are buying these browsers for. Same-origin policy exists because letting content reason across authenticated sessions is dangerous by default — agentic browsers reintroduce that danger as a selling point, then ask users to trust a permission prompt that’s already been shown to fail. Until vendors ship real architectural separation — sandboxing what an agent can read from what it’s authorized to act on, rather than relying on the model’s judgment call — the sane default for anything sensitive is to keep it logged out of your AI browser entirely. The convenience is real. So is the blast radius.
