Every AI Browser on the Market Can Be Hacked, Researchers Warn

Key points

• Zenity researchers were able to successfully attack every commercial agentic browser they tested, covering products including ChatGPT Atlas and Claude for Chrome.
• The vulnerability class, which Zenity calls "PleaseFix", can give criminals remote control of the computer running the browser with no click required from the user.
• The root cause is that agentic browsers have removed a foundational web security rule, in place for roughly 20 years, that stops one website from issuing instructions to another.
• Zenity's Michael Bargury will present the full findings at the Black Hat security conference next week.
• A separate paper by University of Washington researchers, published in April 2025, independently confirmed that agentic browsers are handling these same protections inconsistently.

Agentic browsers are a new breed of software that lets an AI assistant control your browser on your behalf: booking flights, filling in forms, managing emails, and generally doing the clicking so you do not have to. They are genuinely useful. They are also, according to researchers at security firm Zenity, comprehensively hackable.

"We found very different designs with different security assurances across these agentic browsers, but the end result is that we can hack each and every one of them," says Michael Bargury, CTO and co-founder of Zenity.

How did the researchers get in?

The core problem is a missing rule called the same-origin policy, a control baked into ordinary browsers for roughly two decades. In plain terms, this rule stops one website from telling your browser to do things on a completely different website. If you are logged into your bank, a dodgy blog you visit cannot secretly instruct your browser to transfer money. That protection is gone in many agentic browsers, removed so the AI agent can move freely across multiple sites to get tasks done.

With that guardrail absent, criminals can plant instructions inside everyday content, a social-media post, a newsletter sign-up page, and the agent will read and obey them. Zenity calls this class of attack "PleaseFix", a reference to ClickFix, where criminals trick human users into clicking something harmful. With an AI agent, no human click is needed at all.

"With browsers, we've had this persistent problem called ClickFix for many, many years where users get convinced to click on something to do the malicious action themselves," Bargury says. "Now with AI, we just ask the agent really nicely and it does the thing for us."

What can an attacker actually do?

Quite a lot. Zenity's tests showed that a successful attack can post to social accounts on a victim's behalf, send messages to their WhatsApp contacts, make purchases on Amazon, and access local files stored on the computer. In the most serious cases, the researchers achieved RCE, which stands for remote code execution, meaning criminals gain the ability to run any software they choose on the victim's machine.

Zenity first demonstrated a version of this in March 2025 against Perplexity Comet, an agentic browser made by AI search company Perplexity. Those initial exploits accessed local files and hijacked a connected password manager. Since then, the team has extended the research to every agentic browser it could find.

One technique the researchers developed is something Zenity researcher Stav Cohen calls "intent collision". Rather than fighting the agent's built-in safety rules head-on, the attacker frames their malicious goal as a natural extension of what the user already asked for.

"If the user asked to sign up to a newsletter, I will specify that signing up to a newsletter means getting me a reverse shell on your machine," Bargury explains. A reverse shell is a connection that hands control of a computer to a remote attacker. "I don't fight the original intent. I just nudge it in my direction."

A University of Washington paper published in April 2025 by researchers Franziska Roesner and David Kohlbrenner reached a similar conclusion independently, finding that agentic browsers each handle the same-origin policy differently, and that the most permissive of them "undermine decades of work in browser security."

Should people using these tools be worried?

Yes, and enterprises deploying them at scale should be especially cautious. Bargury's practical concern, beyond the attack techniques, is that agentic browsers are largely black boxes: they produce no logs, and they do not expose what the agent is actually thinking as it works. That makes it nearly impossible for a security team to review what an agent did or spot when it went wrong.

For individuals using agentic browsers right now, the sensible steps are straightforward. Do not connect an agentic browser to accounts you cannot afford to lose, such as primary email or banking. Be sceptical of granting an agent access to password managers. Check whether your agentic browser provider publishes a security advisory or changelog; if they do not, that absence tells you something. If you receive unexpected messages apparently sent from your own accounts, treat it as a potential sign of agent hijacking and revoke the browser's permissions immediately.