Security researchers at Zenity Labs say a vulnerability class affecting some of the biggest names in agentic browsing can let attackers hijack AI agents, steal sensitive data and, in some cases, take control of a victim’s computer without requiring an intentional click.
The research, presented at Black Hat USA 2026, expands on Zenity’s earlier work involving Perplexity Comet and shows what the company calls “PleaseFix” attack chains affecting Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Microsoft Copilot in Edge.
At the center of the problem is a collision between traditional browser security boundaries and AI agents that can interpret information across websites, email, calendars, files and authenticated applications.
Zenity describes the attack technique as “Intent Collision.” An attacker embeds malicious instructions in content an AI agent may encounter, such as an email, calendar invitation, webpage or social media post. When a user later gives the agent a legitimate task, the injected instructions can redirect the agent toward attacker-controlled actions.
“Agentic browsers are trading away decades of hard-won security engineering for convenience,” said Michael Bargury, co-founder and CTO of Zenity. “This is not a bug we can patch away. Browsers rely on SOP to isolate any random website you visit from using your logged in banking account. Agentic browsers dismantle that security boundary. An attacker can trivially get their instructions into your agent’s context. Your agent reads anything on any page, including social media posts or the comment section. Once an attacker can push untrusted content into the agent, they inherit all accounts the user logged into, and in some cases direct access to run code on their local machine. This is an over-agency failure, an inherent implication of the design that makes agentic browsers useful.”
In one Claude in Chrome demonstration, Zenity said a malicious email could cause the agent to expose Gmail information, share Google Drive files and contribute to account takeovers involving Slack, X and Claude.
Researchers also demonstrated a Comet attack originating from a poisoned calendar invitation that ultimately reached local files and password-manager workflows. Other demonstrations involved ChatGPT Atlas sending phishing messages through a victim’s WhatsApp account and manipulating an Amazon shopping session.
The most severe scenarios crossed from browser compromise into full device access. Zenity researchers said they reached localhost services through Comet, Gemini in Chrome and Edge, then abused tools including Ollama, Open WebUI, Jupyter and pgAdmin to execute commands or manipulate local systems.
Zenity also disclosed “HistoryFixing,” a persistence technique that plants malicious information in browser history so an AI agent may later treat attacker-controlled entries as trusted context.
The findings underscore an emerging cybersecurity problem for agentic browsers: the more authority an AI agent receives to act on behalf of users, the more damaging prompt injection and trust-boundary failures can become.
