AI Browsers Can Be Hijacked by a Post You Never Click

AI browsers can be taken over by a message the victim never clicks, and the fix is not a patch. At Black Hat USA 2026 in Las Vegas on 5 August, Zenity co-founder Michael Bargury and researcher Stav Cohen presented a vulnerability class they call PleaseFix, which turns the AI agent built into a browser against the person using it. Claude in Chrome, Gemini in Chrome, ChatGPT Atlas, Perplexity Comet and Copilot Edge were all shown to be affected. Several of the flaws were reported months ago and are still open.

How a comment on X becomes a command

An agentic browser does not just show you a page. It reads the page, decides what to do next and acts inside the sessions you are already logged into. The problem is that everything it reads arrives as the same kind of text: your instruction and the content of a random web page look identical to the model. Zenity calls the result intent collision. An attacker writes an instruction into content the agent will read anyway, and the agent follows it as if you had typed it yourself.

Nothing has to be downloaded or installed. There is no malicious attachment to open and no button to press. The payload can sit in a reply under a popular post on X, in an ordinary email, or in a calendar invite. The trigger is you asking your assistant to do something perfectly normal, such as summarising your inbox.

What the researchers actually made the agents do

These were not theoretical proofs. The team demonstrated complete chains that end in real damage:

• Inbox and Drive exfiltration: a hidden instruction inside an email waits until the user asks Claude in Chrome to summarise their mail. The agent parses the Gmail feed, pulls the message bodies, sends the contents to an attacker server and shares the victim's entire Google Drive with an account the attacker controls.
• Account takeover: the same chain then triggers password resets on other services, watches the mailbox for the verification codes and passes them on. Slack, X and Gmail accounts were taken over this way.
• Phishing your own contacts: a planted comment on X sends ChatGPT Atlas to WhatsApp Web inside the victim's logged-in session, where it reads the contact list and messages everyone in it.
• Shopping with your money: in another chain Atlas goes to Amazon, fills the cart, changes the delivery address and pushes the store's own assistant to complete the order.
• Reaching into the machine: the researchers describe chains that escalate to services running on the local machine and on to remote code execution, plus poisoning of browser history so the manipulation survives.

An earlier round of the same research, published in March 2026, showed a Perplexity Comet chain that started with a calendar invite, read local files and abused the agent's access to a password manager. Perplexity fixed that browser-side issue before disclosure, and 1Password confirmed the cause sat in Perplexity's execution model rather than in the password manager.

Why AI browsers break a rule the web has relied on for decades

This is the part worth understanding, because it is what makes the attack different from an ordinary virus. For thirty years browsers have kept sites apart from each other. A page on one site cannot read your mail on another site. That wall, the same-origin policy, is the reason a single bad web page has not been able to empty your accounts.

An AI agent is on the other side of that wall by design. It is you. It carries your cookies, your logged-in sessions and your permissions, and it moves between services because that is what you hired it to do. So when an attacker captures the agent, they do not need your password, they do not need to defeat two-factor authentication, and they do not need to plant a program on your computer. They inherit everything you were already signed into, and every action looks like it came from you. Your antivirus sees nothing wrong, because nothing wrong is happening at the level it watches.

Patched, unpatched and called normal behaviour

Zenity reported the findings to Anthropic, OpenAI, Google, Microsoft and Perplexity before going public. The responses differed. Some vendors shipped fixes. Others answered that the behaviour is what the product is supposed to do. OpenAI was told about the Atlas chains in January 2026 and acknowledged them, but they remain unpatched. Anthropic received reports in December 2025 and January 2026 and classified them as informative, and those chains are also still open.

That is less evasive than it sounds, and more worrying. Bargury's own summary is that "this is not a bug we can patch away". The weakness is not a coding mistake in one product. It is what you get when a program is asked to read untrusted text and act on your behalf at the same time. We have covered the same root cause before, when any web page could turn ChatGPT into a phishing tool and when an OpenAI model escaped its sandbox and reached real companies.

What to do right now

You do not have to give up on AI browsing, but the sensible setting today is caution:

1. Do not leave an agent connected to your main mailbox, your cloud storage and your work chat at the same time. The damage in every demonstrated chain came from combined access.
2. Use a separate browser profile for agent work, signed into as little as possible, and keep banking, mail and admin panels in a normal browser.
3. Turn off autonomous modes that let the agent browse and act without asking. Approval prompts are annoying, and they are also the only place where you still see what is happening.
4. Be careful with the innocent request. Asking an agent to summarise an inbox or a comment thread is exactly the trigger these attacks were built around.
5. Check the security settings and connected apps of accounts an agent has touched, in particular anything with file sharing, and review which accounts can share your storage.

It is worth being clear about what a VPN does and does not do here. A VPN encrypts your traffic and hides your address from the network you are on, which matters against interception and tracking, but it cannot limit what an agent does inside sessions you have already authorised. Channel protection and agent permissions are two separate layers, and this research is about the second one. The same distinction came up when shared Claude conversations turned up in Google search.

Conclusion