AI Browsers Can Be Hijacked by Hidden Instructions in Emails and Web Pages, Researchers Warn
A new attack class called 'PleaseFix' lets criminals slip fake commands into ordinary content, and the AI does the rest, using your own accounts against you.
Key points
- Five major AI-powered browsers, including Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge, are vulnerable to a newly demonstrated class of attack.
- Researchers from Zenity Labs presented the findings at Black Hat USA 2026 in Las Vegas this week.
- Attackers do not need to trick a user into clicking anything; a poisoned email, calendar invite, or web page is enough to trigger a hijack.
- In one live demonstration, a malicious Amazon link caused an AI agent to complete a fraudulent purchase using the victim's credit card.
- No single patch fixes the problem; the researchers say the flaw is built into how AI agents currently work.
Picture hiring a very capable assistant who already has the keys to your email, your calendar, your work files, and your bank. Now picture a stranger being able to whisper instructions to that assistant through a sticky note left inside a document. That is, roughly, what security researchers from Zenity Labs showed the world this week at Black Hat USA 2026 in Las Vegas.
The group demonstrated a new category of attack they call "PleaseFix," targeting what the industry calls agentic browsers: AI-powered browsing tools, meaning web browsers that use artificial intelligence to carry out tasks on your behalf. Products in this category include Claude in Chrome (Anthropic's AI assistant embedded in Google's browser), Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Microsoft Copilot Edge.
How does the attack actually work?
These AI browsers break a longstanding security rule that keeps websites from reading each other's data. AI agents mix content from many sources to complete a task, and that mixing is exactly the opening attackers exploit.
Zenity Labs calls the core technique "Intent Collision." When the AI reads an email or a web page to help you, it cannot reliably tell the difference between the content you asked it to read and secret instructions hidden inside that content. An attacker who plants those instructions can redirect the AI to act in their interests instead of yours, using your own logged-in accounts to do it.
The attack requires zero clicks from the victim. The malicious instruction just needs to end up somewhere the AI reads.
What could a real attacker actually do?
The demonstrations were specific, and they were damaging.
With Claude in Chrome, asking the AI to summarise a weaponised email triggered automatic sharing of the victim's Google Drive, theft of Gmail data, and account takeovers across Slack, X, and Claude itself.
| Browser | Trigger | Demonstrated outcome |
|---|---|---|
| Claude in Chrome | Poisoned email | Gmail theft, Google Drive shared, Slack and X hijacked |
| Perplexity Comet | Malicious calendar invite | Local files and password-manager credentials stolen |
| ChatGPT Atlas | Ordinary-looking link on X | Phishing messages sent via victim's WhatsApp |
| ChatGPT Atlas | Amazon product link | Fraudulent purchase charged to victim's credit card |
With Perplexity Comet, a fake calendar invitation handed attackers access to local files and saved passwords, without the victim ever interacting with anything suspicious.
Should ordinary people be worried right now?
Yes, but the practical risk today is higher for workplaces than for individuals. If you use an AI browser and stay logged in to work tools such as email, GitHub, or internal systems while you use it, you are expanding the surface a hidden instruction could reach.
Stav Cohen, AI security research team lead at Zenity, described the situation plainly: "An AI browser acts on the web as your employee, already logged in to their email, files, calendar, and work apps. If an attacker can slip hidden instructions into something the agent reads, they can turn it against the user, from inside your network, using your employee's own access."
Zenity's practical advice is blunt. Do not log in to work accounts through an AI browser. Review what permissions the browser holds and turn off defaults you do not need. Do not rely on a simple "ask before acting" confirmation pop-up as your only safeguard, because the hidden instruction can be crafted to pass that check.
The researchers say vendors can and should close individual attack paths as they find them, but the underlying design flaw cannot be erased with a single update. The AI has to read untrusted content from the open web to function at all, and that content can be tampered with.
