Loading story…
Researchers disclosed a class of vulnerabilities dubbed PleaseFix that affects commercial agentic browsers by weakening or removing long-standing browser security controls, particularly cross-origin protections. Zenity researchers Michael Bargury and Stav Cohen said they were able to exploit every agentic browser they tested, with impacts ranging from account takeover and abuse of active user sessions to browser escape and potential remote code execution on the host system.
The attacks reportedly use benign-looking web content and simple natural-language instructions, including malicious social media posts and a technique called intent collision, to coerce browser agents into unauthorized actions without relying on classic prompt injection. The findings describe the problem as a systemic weakness in current agentic browsers, with prior research also showing inconsistent enforcement of the same-origin policy, and researchers urged AI labs and browser vendors to add stronger isolation, telemetry, transparency, and other security controls before enterprise adoption expands.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
Zenity researchers reported a class of vulnerabilities dubbed 'PleaseFix' affecting commercial agentic browsers, saying weakened or removed browser security controls enabled attacks such as account takeover, session abuse, browser escape, and possible remote code execution. They said they were able to exploit every agentic browser they tested using benign-looking content and natural-language instructions.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Commentary and research coverage warned that **AI agents**—including “agentic browsers” that act on a user’s behalf—are creating new enterprise attack surfaces faster than governance and detection are maturing. SC Media argued organizations should not wait for NIST guidance to treat AI agents as a security priority, citing a lack of visibility into what agents can access and do (tools, data, actions, and auditability) and emphasizing that agents can cause harm through authorized-but-dangerous actions even without traditional “compromise.” Dark Reading, citing **Trail of Bits** research, described how agentic browsers can undermine decades of browser security hardening by treating the agent as a trusted proxy that can traverse tabs and local resources, weakening isolation assumptions that underpin controls like the **same-origin policy**. Trail of Bits’ findings highlighted practical abuse paths where attackers can manipulate an agent’s context (for example via **reflected XSS**) and then induce **data exfiltration** by persuading the agent to send local or cross-tab information to attacker-controlled infrastructure—classes of attacks that modern browsers have made significantly harder for direct user sessions. Other items in the set were general risk-management or unrelated vulnerability/news pieces (e.g., Oracle patch volume, GitLab 2FA bypass, cloud demo misconfigurations, and enterprise browser selection guidance) and did not materially add to the specific story about agentic/AI-agent security regression and emerging exploitation techniques.
Jun 29, 2026
Researchers and vendors have disclosed serious security weaknesses in AI-enabled browsers, warning that agentic features can undermine core browser protections such as the same-origin policy, tab isolation, and safe handling of cross-origin content. A study cited by *Live Science* found inconsistent security behavior across seven AI browsers and concluded that more capable products often introduced greater risk, including exposure through prompt injection, multi-tab visibility, and unsafe memory handling. Brave separately detailed indirect prompt injection risks in its discussion of Perplexity Comet, highlighting how malicious web content can manipulate browser agents through embedded instructions. A separate vulnerability chain in OpenAI’s ChatGPT Atlas browser showed how these design risks can translate into account-compromise scenarios. According to Hacktron AI, exposed Chromium Mojo IPC interfaces were reachable from broadly allowlisted OpenAI web origins, and researchers chained a `postMessage`-based XSS on `forums.openai.com` with a login CSRF flaw to execute JavaScript on an authenticated OpenAI domain. From there, they were able to control Atlas browser functions, enumerate and manipulate tabs, and continuously read live tab URLs, enabling theft of OAuth authorization codes that could lead to takeover of accounts such as GitHub, Reddit, and Facebook. OpenAI said it fixed the issue in Atlas version `1.2025.288.15` and awarded a $5,000 bounty.
Jul 24, 2026
Security researchers at **Zenity Labs** disclosed **PleaseFix**, a family of critical vulnerabilities affecting *agentic browsers*—including **Perplexity’s Comet**—that enable **AI agent hijacking** via *indirect prompt injection* embedded in routine workflows. In the Comet-specific **PerplexedBrowser** variant, attackers can trigger unauthorized agent actions inside an authenticated user session, including **local file access** and **data exfiltration**, while the agent continues to behave normally from the user’s perspective, reducing the chance of detection. One demonstrated attack uses a **poisoned Google Calendar invite**: hidden content (e.g., whitespace-obscured elements and a `system_reminder`-style instruction block) is processed when a user asks Comet’s agent to handle the invite, causing an “intent collision” where the agent merges the user’s request with attacker instructions. The payload can drive background navigation to attacker-controlled infrastructure, bypass language-focused guardrails by switching languages (e.g., Hebrew), coerce the agent into reading sensitive `file://` resources (configuration files, API keys), and exfiltrate data by embedding it into outbound requests. A second exploit path described by Zenity Labs abuses agent-authorized workflows to manipulate password-manager interactions—potentially enabling **credential theft** (including from an unlocked **1Password** session) and **account takeover** without directly exploiting the password manager itself.
Jun 29, 2026