AI agents in browsers break the long-standing web security model

The race to embed autonomous agents in browsers has produced a new family of vulnerabilities called PleaseFix, which enables full Zero-Click takeover of a computer. The research, conducted by Israeli cyber security firm Zenity Labs, was presented last night at Black Hat USA 2026 in Las Vegas and shows that leading agents—Claude in Chrome, Gemini in Chrome, Perplexity Comet, Atlas (ChatGPT) from OpenAI and Copilot in Edge—do not respect the Same-Origin Policy (SOP), the backbone of web security for decades.

SOP prevents one site from accessing data or performing actions on another site on behalf of the user, for example stopping a response on ynet from touching an open banking account in a neighboring tab. The AI agents, built to traverse sites and carry out complex tasks, break this separation through a technique dubbed Intent Collision: when the agent encounters malicious content (in an email, token back, or post), the attacker’s instructions clash with the user’s original request, confusing the agent and handing all user privileges to the attacker.

The researchers demonstrated extreme scenarios in every tested browser. Claude from Anthropic, a single malicious email allowed extraction of Gmail data, sharing of the entire Google Drive contents and takeover of Slack and X accounts, even when the user had enabled a mode that requires prior approval. In Perplexity Comet, a malicious calendar invitation opened access to the local file system and logged the user out of 1Password. In Atlas (ChatGPT) from OpenAI, a single link caused the agent to send phishing messages via WhatsApp and make an Amazon purchase by recruiting the assistant Rufus to complete the transaction.

Equally serious is the ability to reach the Localhost environment, the innermost part of the machine. Agents in Comet, Gemini and Edge bypassed restrictions, executed a reverse shell or corrupted databases, granting attackers full control of the device. A second technique, HistoryFixing, permits planting of forged entries in the browsing history; the entries remain buried and poison the agent’s future decision-making, leading to deletion of active servers on AWS and leakage of private history.