Every AI Browser on the Market Can Be Hacked, Researchers Warn

Key points

• Zenity researchers successfully attacked every commercial agentic browser they tested, including ChatGPT Atlas and Claude for Chrome.
• The vulnerability class, which Zenity calls PleaseFix, can give criminals remote control of the computer running the browser with no click required from the user.
• The root cause is that agentic browsers have removed a foundational web security rule, in place for roughly 20 years, that stops one website from issuing instructions to another.
• Zenity's Michael Bargury will present the full findings at the Black Hat security conference next week.
• A University of Washington paper published in April 2025 independently confirmed that agentic browsers handle these protections inconsistently.

Agentic browsers let an AI assistant control your browser on your behalf: booking flights, filling in forms, doing the clicking so you do not have to. Useful, certainly. Also, according to researchers at security firm Zenity, comprehensively hackable.

"We found very different designs with different security assurances across these agentic browsers, but the end result is that we can hack each and every one of them," says Michael Bargury, co-founder and CTO of Zenity.

How did the researchers get in?

The core problem is a missing control called the same-origin policy, baked into ordinary browsers for roughly two decades. In plain terms, it stops one website from telling your browser to act on a completely different website. Logged into your bank, a dodgy blog you visit cannot secretly instruct your browser to transfer money. That protection is absent in many agentic browsers, removed so the AI agent can move freely across multiple sites.

With that guardrail gone, criminals can plant instructions inside everyday content. A social-media post, a newsletter sign-up page, and the agent will read and obey. Zenity calls this attack class PleaseFix, a nod to ClickFix, where criminals trick human users into clicking something harmful. No human click is needed with an AI agent.

"With browsers, we've had this persistent problem called ClickFix for many, many years where users get convinced to click on something to do the malicious action themselves," Bargury says. "Now with AI, we just ask the agent really nicely and it does the thing for us."

Our 16 July story "AI Agents Can Go Rogue. Your Security Model Was Never Built to Stop Them." reached a similar structural conclusion: AI agents break every assumption four decades of security thinking was built on.

What can an attacker actually do?

Quite a lot. Zenity's tests showed a successful attack can post to social accounts on a victim's behalf, send messages to their WhatsApp contacts, make purchases on Amazon, and access local files on the computer. In the most serious cases, the researchers achieved remote code execution, meaning criminals gain the ability to run any software they choose on the victim's machine.

Zenity first demonstrated a version of this in March 2025 against Perplexity Comet, an agentic browser made by AI search company Perplexity. Those exploits accessed local files and hijacked a connected password manager. Since then, the team extended the research to every agentic browser it could find.

One technique the researchers developed is something Zenity researcher Stav Cohen calls "intent collision". Rather than fighting the agent's built-in safety rules directly, the attacker frames their malicious goal as a natural extension of what the user already asked for.

"If the user asked to sign up to a newsletter, I will specify that signing up to a newsletter means getting me a reverse shell on your machine," Bargury explains. A reverse shell is a connection that hands control of a computer to a remote attacker. "I don't fight the original intent. I just nudge it in my direction."

A University of Washington paper published in April 2025 by researchers Franziska Roesner and David Kohlbrenner reached a similar conclusion independently, finding that each type of agentic browser handles the same-origin policy differently, and that the least restrictive of them "undermines decades of work in browser security."

Should people using these tools be worried?

Yes, and enterprises deploying them at scale should be especially cautious. Beyond the attack techniques themselves, Bargury's practical concern is that agentic browsers are largely black boxes: no logs, no visibility into what the agent is thinking as it works. That makes it nearly impossible for a security team to review what an agent did or catch it going wrong.

For individuals using these tools right now, the sensible steps are concrete. Don't connect an agentic browser to accounts you cannot afford to lose, such as primary email or banking. Be sceptical of granting an agent access to password managers. Check whether your provider publishes a security advisory or changelog; silence there tells you something. If you receive unexpected messages apparently sent from your own accounts, treat it as a potential sign of agent hijacking and revoke the browser's permissions immediately.

The deeper problem here isn't the cleverness of any individual exploit. It's that the industry shipped capability before it shipped accountability, and right now nobody outside the attacking team knows what these agents did while you were away from the keyboard.