Black Hat USA 2026 – Las Vegas – Browsers such as Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge are vulnerable to a new class of zero-click exploits that can allow attackers to hijack their artificial intelligence agents and turn them against users.
The problem stems from how the AI agents pull information from multiple sources, such as emails and webpages, while working on a task without reliably distinguishing between trusted and untrusted content. An adversary who can slip malicious instructions into that content can weaponize the agent and use its access to act on the user’s behalf, potentially reaching sensitive data, accounts, and other connected services.
Researchers from Zenity Labs, who call the vulnerability class “PleaseFix,” demonstrated the risk at a session at Black Hat USA 2026 this week.
A Fundamental Break in AI Browsers
Agentic browsers, according to the company, fundamentally break the same-origin browser security rule that prevents one website from freely accessing data or resources belonging to another website. AI agents combine and act on content from different websites and sources rather than keeping those sources isolated from one another.
“PleaseFix exploits this trust model by placing malicious instructions inside content the agent encounters, such as emails, calendar invitations or web pages,” Zenity said in a press release on Monday. “Through a technique Zenity Labs calls ‘Intent Collision,’ those hidden instructions interfere with the user’s legitimate request and redirect the agent to act on the attacker’s behalf using the user’s own identity, permissions and access.”
Zenity demonstrated how attackers could potentially exploit the issue across the different agentic browsers and attack scenarios. With Claude in Chrome, for instance, the researchers showed how a simple request to summarize an email containing malicious instructions could trigger an attack that enabled the exfiltration of Gmail data; sharing of the victim’s Google Drive; and takeover of accounts, including Slack, X, and Claude.
With Perplexity Comet, the researchers showed how an attacker could use a poisoned calendar invitation to hijack the agent without any user interaction, and use it to access local files and password-manager workflows to steal sensitive data and credentials. Similarly, with ChatGPT Atlas, the researchers showed how an ordinary-looking link on X could hijack the agent’s workflow and get it to send phishing messages through the victim’s WhatsApp account. In another attack, they showed how they could manipulate an Amazon order and co-opt Amazon’s AI assistant into completing a fraudulent purchase using the victim’s credit card.
“An AI browser acts on the Web as your employee, already logged in to their email, files, calendar, and work apps,” explains Stav Cohen, AI security research team lead at Zenity. “If an attacker can slip hidden instructions into something the agent reads, they can turn it against the user, from inside your network, using your employee’s own access.”
Agents’ Inability to Discern
The problem is that AI agents cannot tell the difference between ordinary content and malicious hidden instructions inside that content in an email, a shared document, a calendar invite, or a webpage. “The takeaway is not ‘there’s a bug to patch,'” Cohen says. “It’s that a powerful new insider has appeared inside your environment, one that can be hijacked by everyday content, and it doesn’t fit the assumptions your defenses were built on.”
While there is no single fix for the problem, there are measures that organizations can take to limit potential damage from intent collision attacks, he says. The mindset to adopt is to assume the agent will get hijacked, figure out the worst it could do, and then take away everything it doesn’t truly need.
Practically, that means reviewing the browser’s setting and disabling defaults, not signing in to work accounts — such as email, AWS, GitHub, etc. — with an AI browser, limiting where the browser is allowed to act, and not relying solely on an “ask before acting” pop-up alone.
“The core problem is simple: The agent can’t reliably tell the difference between content it was asked to read and hidden instructions buried inside that content,” Cohen notes. “The fix isn’t to keep asking the AI to behave. It’s to put hard limits around the agent that the agent cannot override, and to ship those limits switched on by default.”
While Cohen says the issue is a design flaw in agentic browsers that can’t be resolved via patching alone, vendors can and should patch individual exploit paths where possible. “For an AI browser to work at all,” he says, “the agent has to read and act on content from the open web, and that content is untrusted and can be tampered with.”
