--- title: "AI Browsers Keep Getting Hijacked, and Nobody Claims a Fix" pubDatetime: 2026-08-06T07:00:00.000Z description: "Black Hat USA 2026 brought zero-click prompt-injection demos against Comet, Atlas, Claude in Chrome, Gemini in Chrome and Copilot Edge. Vendors patch the individual holes fast; researchers keep finding new ones in the same trust model." tags: [ai-security, prompt-injection, ai-agents, security, lethal-trifecta, 2026, 2026-q3, 2026-08] --- > [!tldr] TL;DR > At Black Hat USA 2026 this week, researchers from Zenity and Brave demonstrated zero-click hijacks of AI browser agents across Perplexity Comet, ChatGPT Atlas, Claude in Chrome, Gemini in Chrome, Copilot Edge and Opera, with malicious instructions hidden in emails, calendar invites, pages and images. Both talks landed on the same conclusion Dark Reading reported as "no known perfect solution to prompt injections in AI browsers." Vendors are patching quickly, and Perplexity closed the core execution flaw behind Zenity's file-exfiltration exploits before the March 3, 2026 disclosure. The layered defenses on offer, profile isolation and a capability floor and an action-checking model, reduce exploitability without closing the class. Treat an agentic browser as software that will eventually run an attacker's instructions with your session cookies. Zero-click means what it sounds like. You do not click a link, approve a dialogue, or paste anything. An email arrives, or a calendar invite, or a page your agent reads on your behalf, and instructions buried in that content become instructions your browser agent follows. It already holds your logged-in sessions, so it acts as you. That was the shape of both Black Hat USA 2026 briefings covered by Dark Reading on Wednesday. Zenity's Stav Cohen presented the [PleaseFix vulnerability family and "Intent Collision"](https://www.darkreading.com/cyber-risk/ai-browsers-zero-click-agent-hijacking), with walkthroughs against Claude in Chrome, Comet and Atlas. Brave's Artem Chaikin, in ["Attacking and Defending AI Browsers"](https://www.darkreading.com/application-security/no-perfect-fix-ai-browser-prompt-injection-flaws), showed injection working across Opera, Comet and Atlas. ## PleaseFix: Six Attack Subfamilies, Five Vendors Zenity Labs disclosed [PleaseFix](https://zenity.io/research/pleasefix-vulnerabilities) on March 3, 2026, 156 days ago. The family covers six subfamilies, including Claude-Site Scripting, PerplexedBrowser, GrandTheftAtlas, Agent127 and HistoryFixing. Affected products span Perplexity Comet, ChatGPT Atlas, Claude in Chrome, Gemini in Chrome and Copilot Edge. The [disclosure release](https://www.businesswire.com/news/home/20260303909038/en/Zenity-Labs-Discloses-PleaseFix-Vulnerability-Family-in-Perplexity-Comet-and-Other-Agentic-Browsers) is worth reading for the vendor responses. Perplexity said it had already fixed the browser-side execution issue behind the file-exfiltration and credential-theft exploits before Zenity went public. 1Password, whose vault contents featured in the credential-theft chain, said the root cause sat in Perplexity's execution model rather than in its own product. Both statements are defensible. Both illustrate the problem. The vulnerability was in how one browser decided which text counted as an instruction, a decision every agentic browser has to make on every page it reads. ## The Case That This Is Overstated The strongest pushback on the "unfixable" framing is that it flattens real progress. Nobody in the sources argues prompt injection is solvable, so the argument runs elsewhere: disclosure works, patches ship, and defense in depth measurably raises the cost of an attack. OpenAI CISO Dane Stuckey put the optimistic version to [The Register in October 2025](https://www.theregister.com/2025/10/28/ai_browsers_prompt_injection/), calling prompt injection "a frontier, unsolved security problem" while arguing a "proactive, highly responsive rapid-response loop can continue to materially reduce real-world risk over time." Independent researcher Johann Rehberger, in the same piece, was blunter: prompt injection cannot be fixed. Chaikin's talk carried both halves. He conceded no single fix exists, then described what Brave actually ships: isolated logged-out browsing profiles so the agent has no session to steal, a floor on model capability that blocks downgrade attacks below Claude Haiku 4.5, and a "sentinel" model that checks agent actions for alignment before execution. Those are specific, they are engineering, and they help. They also assume the checking model is harder to talk out of its job than the agent it supervises. That is an empirical bet, and Black Hat is where empirical bets go to get tested. ## A Year of the Same Structure Zenity CTO Michael Bargury demonstrated [AgentFlayer](https://www.darkreading.com/application-security/ai-agents-access-everything-zero-click-exploit) at Black Hat USA 2025, 363 days ago: a zero-click chain against ChatGPT, Copilot Studio, and Cursor wired to Jira over MCP. Different products, no browsers involved, identical structure. Hidden text reaches an agent, the agent inherits the user's trust, data leaves. A year on, the same lab is on the same stage with the same finding aimed at consumer browsers. The targets moved outward from enterprise agent platforms to the thing your parents might install. The trust model did not change. ## What To Do With This The honest summary is that an AI browser agent is a program with your credentials that executes text from strangers. Every mitigation shrinks the blast radius of that fact without removing it. The UK NCSC, OpenAI, and the researchers breaking these products all agree on the shape of the problem, which is rare enough to take seriously. Practical reading: keep agentic browsing in a profile with nothing logged in, treat any agent with access to email plus a password manager plus the open web as compromised-by-default, and do not extend an AI browser more standing authority than you would give a browser extension from a developer you have never met. Vendors will keep patching. Zenity will keep presenting in August. --- *Sources: [PleaseFix: Zero-Click AI Agent Vulnerabilities](https://zenity.io/research/pleasefix-vulnerabilities) • [Zenity Labs Discloses PleaseFix Vulnerability Family](https://www.businesswire.com/news/home/20260303909038/en/Zenity-Labs-Discloses-PleaseFix-Vulnerability-Family-in-Perplexity-Comet-and-Other-Agentic-Browsers) • [AI browsers face a security flaw as inevitable as death and taxes](https://www.theregister.com/2025/10/28/ai_browsers_prompt_injection/)* *Coverage: [AI Browsers: Zero-Click Agent Hijacking](https://www.darkreading.com/cyber-risk/ai-browsers-zero-click-agent-hijacking) • [No Perfect Fix for AI Browser Prompt Injection Flaws](https://www.darkreading.com/application-security/no-perfect-fix-ai-browser-prompt-injection-flaws) • [AI Agents Access Everything, Fall to Zero-Click Exploit](https://www.darkreading.com/application-security/ai-agents-access-everything-zero-click-exploit)* *Related on this blog: [Three Indirection Steps From a Reverse Shell](/posts/ai-agent-security-lethal-trifecta) • [One Word Beat GitHub's Guardrail, and the Word Was 'Additionally'](/posts/gitlost-github-agent-injection) • [[AUTO] Guardrails Are Usability Theater](/posts/auto-guardrails-usability-theater)*