Security Flaws in AI Browser Agents Expose Users to Remote Takeover Attacks
A new cybersecurity study by Israeli firm Zenity Labs, revealed at the Black Hat USA 2026 conference in Las Vegas, exposes critical vulnerabilities in autonomous AI agents integrated into popular web browsers. These flaws, dubbed PleaseFix, enable zero-click attacks that allow hackers to fully control AI agents in browsers such as Anthropic's Claude on Chrome, Perplexity's Comet, Google's Gemini on Chrome, OpenAI's Atlas ChatGPT, and Microsoft's Copilot on Edge.
The vulnerabilities stem from AI agents disregarding the long-standing Same-Origin Policy (SOP) that prevents websites from accessing data across different domains. AI agents designed to perform complex tasks across multiple sites blur these boundaries, enabling attackers to exploit a technique called Intent Collision. Malicious content embedded in social media posts, comments, or emails can confuse the AI agent, causing it to grant attackers full user permissions without any user interaction.
Zenity Labs demonstrated severe attack scenarios: in Anthropic's Claude, a single malicious email could expose Gmail data, Google Drive files, and Slack and X accounts, even with enhanced security modes enabled. Perplexity's Comet allowed attackers to access local files and lock users out of password managers, while OpenAI's Atlas enabled phishing via WhatsApp and unauthorized Amazon purchases using Amazon's AI assistant. Moreover, AI agents in Comet, Gemini, and Edge bypassed security to reach the local machine environment, executing reverse shells and database corruption to gain full device control.
The researchers also uncovered a HistoryFixing technique that implants fake browsing records, poisoning AI decision-making and causing destructive actions like deleting active AWS cloud servers and leaking private browsing histories. Zenity Labs co-founder and CTO Michael Bergory explained that integrating AI agents into browsers inherently conflicts with traditional security models, as AI agents can be tricked into performing unauthorized actions across sites.
The report highlights a recurring pattern where prioritizing user convenience over robust security leads to critical vulnerabilities, reminiscent of past issues like Microsoft's ActiveX and Cross-Site Scripting (XSS). The AI era introduces a new failure mode called Over-Agency, where autonomous AI decision-making opens doors to social engineering attacks directly targeting the AI model.
Zenity Labs responsibly disclosed these findings to major tech companies including Google, Microsoft, OpenAI, Anthropic, and Perplexity. While some promptly issued security patches, others defended the behaviors as intentional design features. This mixed response underscores the lack of industry standards and the precarious balance between AI assistant functionality and security in the race to develop the next-generation AI browser.
