Zero-Click Hijacking Exposes a Core Security Risk in AI Browsers

Google News surfaced a warning that AI browsers can be hijacked without a victim clicking, approving, or knowingly opening a malicious command. Security researchers say crafted content can redirect an agent while it performs an ordinary task. The same automation that saves time can then expose files, credentials, messages, or authenticated accounts.

The research centers on PleaseFix, a vulnerability class that Zenity Labs introduced in March 2026 and expanded at Black Hat USA. Unlike conventional social engineering, the attack targets the software acting for the user. A calendar invitation, social post, website, or newsletter form can become the instruction channel.

This creates a conflict browser makers cannot dismiss as another isolated bug. AI browsers need broad access to complete useful work across websites. That access becomes dangerous when the agent cannot reliably separate the user's goal from instructions placed inside untrusted content.

Dark Reading reported that Zenity researchers found attack paths across major agentic browser designs, including products connected to OpenAI, Google, Anthropic, Microsoft, and Perplexity. The important question is no longer whether one product needs a patch. It is whether autonomous browsing can preserve familiar Web security boundaries while still acting with a user's authority.

PleaseFix Turns Routine Content Into an Attack Trigger

PleaseFix shifts social engineering from persuading a person to redirecting the agent that already has the person's authority.

Traditional ClickFix attacks convince users to perform an unsafe action, often by copying a command or approving a suspicious prompt. PleaseFix removes that human bottleneck. An attacker instead places instructions where an AI browser will encounter them during a normal workflow.

Zenity initially disclosed PleaseFix on March 3, 2026. Its researchers demonstrated two exploit paths involving Perplexity Comet. One could use a calendar invitation to steer the browser agent toward local files and send their contents to an attacker-controlled destination.

The second path targeted password-management workflows. According to Zenity, the attacker did not need to exploit the password manager directly. The malicious content redirected the browser agent while it operated inside an authenticated session.

Perplexity fixed the underlying browser-side issue before the public disclosure. Zenity said 1Password confirmed that the root cause was not inside its password manager. That distinction matters because the agent acted as an authorized intermediary between otherwise legitimate systems.

The technical category is indirect prompt injection. This happens when an AI model treats untrusted data as an instruction, even though the user never issued that instruction. A webpage, email, document, or calendar event can carry the malicious text.

The attack can remain hidden while the agent completes the visible task. A user might ask an AI browser to accept an invitation or summarize a page. The agent can return the expected answer while performing an additional action chosen by the attacker.

Zenity co-founder and CTO Michael Bargury described the flaw as an agent trust failure, not merely a defective password manager or website. The company's PleaseFix research says the injected instruction inherits whatever access the user granted to the agent.

That inherited access changes the impact. A compromised webpage normally operates within browser restrictions. A compromised agent can navigate tabs, read connected services, enter text, click controls, and invoke other tools.

At Black Hat, the researchers broadened the finding beyond the original Comet demonstrations. They described a technique called intent collision. It avoids directly telling an agent to abandon the user's request.

Instead, the malicious content supplies a false definition of how the request should be completed. If the user asks to join a newsletter, the attack can tell the agent that an unrelated malicious action is part of registration.

The agent still appears aligned with the original task. It has simply accepted an attacker-controlled path toward completing it. This makes simple checks for obviously conflicting instructions less effective.

Dark Reading's July reporting said Zenity found materially different designs and security guarantees across agentic browsers. Yet the researchers said each product exposed some attack route. That pattern turns zero-click agent hijacking into a category problem.

A single patch can close a demonstrated chain. It does not remove the underlying collision between untrusted content, autonomous decisions, and authenticated access.

Why AI Browsers Put Familiar Web Boundaries Under Pressure

An AI browser gains usefulness by crossing boundaries that conventional browsers spent decades enforcing.

The same-origin policy is one of those boundaries. It generally prevents content from one website from reading or manipulating content belonging to another. A malicious page should not gain access to an open banking, email, or workplace session.

Browser agents complicate that model because cross-site activity is part of their purpose. A travel task might require reading a booking site, comparing maps, opening email, entering payment details, and updating a calendar. The agent needs broader visibility than any single webpage receives.

University of Washington researchers tested seven agentic browsers in early 2026. Their same-origin study examined Brave Leo AI, ChatGPT Atlas, Chrome with Gemini, Claude for Chrome, Microsoft Edge with Copilot, Firefox AI Mode, and Perplexity Comet.

The team demonstrated a complete cross-origin data-theft attack against ChatGPT Atlas in Agent Mode. Researchers also found conditions for related attacks in Chrome with Gemini, Claude for Chrome, and Perplexity Comet if prompt injection succeeded.

In the proof of concept, a malicious site embedded content from another origin. An injected instruction directed the agent to read that content and place it into a form that submitted automatically. The agent became the bridge that ordinary browser code was prohibited from creating.

The researchers did not claim that every tested product suffered the same complete exploit. Their finding was more structural. Several designs reduced the effectiveness of the same-origin policy to the effectiveness of prompt-injection defenses.

That is a demanding dependency. Prompt injection is not a conventional signature that defenders can reliably block once and forget. Attackers can rewrite an instruction, hide it in visual content, split it across elements, or frame it as part of the task.

A person might ignore faint text or inaccessible page metadata. A multimodal agent can extract and act on that information. Cloud Security Alliance notes that researchers have demonstrated instructions with colors that humans struggle to perceive but AI systems can still read.

Memory creates another boundary problem. Agents can compress prior activity into summaries that influence later behavior. If hostile content reaches that memory, its original source can become less visible during future decisions.

LayerX previously described Tainted Memories, an attack that placed malicious instructions into ChatGPT Atlas memory. Other disclosures have used URL fragments, shared documents, and server-side retrieval paths to deliver adversarial instructions.

These methods differ, but they exploit the same ambiguity. The model receives user intent and external content through channels that do not provide dependable instruction provenance.

Instruction provenance means knowing who supplied a command and what authority it should carry. Conventional software can label code, input, permissions, and processes through explicit technical structures. Language models often receive these elements as text within a shared context.

AI browsers therefore pressure security teams in two directions. Restricting access reduces damage, but it also reduces the tasks an agent can finish. Expanding access improves automation while increasing the consequences of one bad decision.

The University of Washington team observed that the least risky browser in its tests also had the most limited capabilities. That finding captures the central tradeoff. Capability and exposure are being increased by many of the same design choices.

Google News Headlines Hide a Deeper Permission Problem

The headline is about malicious prompts, but the larger security failure concerns permissions that survive after the agent misreads one instruction.

Google News can make zero-click agent hijacking look like another fast-moving vulnerability story. That framing risks focusing attention on the clever payload instead of the authority available after the payload works.

An AI assistant that only summarizes public pages has a limited blast radius. An agent that can read email, access local files, use stored credentials, message contacts, and make purchases presents a different risk.

The attack does not need to defeat each connected service independently. It can manipulate the agent that has already been approved to use them. Legitimate authentication becomes part of the attack chain.

This resembles a confused deputy, a security problem in which a trusted component misuses its authority for another party. The AI browser believes it is serving the user while an attacker influences how it interprets the user's goal.

PleaseFix demonstrates this problem through ordinary content. Other research extends it across different delivery channels. GeminiJack reportedly used shared Google documents containing hidden instructions. HashJack placed instructions after the hash symbol in URLs, an area network controls may ignore.

ZombieAgent targeted retrieval behavior in an AI research agent. CometJacking used crafted query parameters and required a click. The variations show that defenders cannot secure only webpages while leaving email, documents, memory, and tool responses untreated.

NIST has defined agent hijacking as a form of indirect prompt injection that causes an agent to pursue an attacker's objective. Its hijacking evaluations emphasize testing whether agents complete malicious goals hidden inside resources they process.

That evaluation approach is important because a system can look safe during ordinary benchmark tasks. It can also block a familiar injection phrase while remaining vulnerable to a differently worded instruction.

Intent collision makes the testing problem harder. The hostile content does not always contradict the user's request. It can claim that the malicious step is necessary for completing the request.

A narrow alignment check might see a newsletter registration request followed by form interactions and conclude that the plan remains relevant. It must also detect that one proposed action crosses into an unrelated origin, tool, or privilege.

Permissions should therefore attach to a specific task, not merely to the agent's general identity. A request to summarize a webpage does not require access to a password manager. Accepting a calendar invitation should not authorize local file uploads.

Short-lived, task-scoped permissions would reduce the blast radius. So would explicit separation between read access and write access. An agent might inspect several sources without receiving authority to transmit their contents elsewhere.

The same principle applies to enterprise deployments. A browser agent connected to customer records, internal documents, code repositories, and messaging systems should not receive one undifferentiated permission set.

Security teams also need visibility into agent actions. Traditional logs may show an authenticated user session performing valid requests. They may not show whether those requests came from the person, the agent's planner, or adversarial content.

This weakens familiar detection logic. There may be no stolen password, suspicious executable, or unauthorized login. The harmful activity can occur through an approved browser on an approved device.

For enterprise buyers, the key product question is not whether a browser includes prompt-injection filtering. Buyers should ask how the system scopes authority, records instruction sources, isolates origins, and stops unexpected data movement.

Browser Makers Are Building Guardrails, but None Ends the Tradeoff

Layered defenses can interrupt known attack paths, yet no published architecture removes the underlying tension between autonomy and control.

Google openly identifies indirect prompt injection as the primary new threat facing agentic browsers. Its proposed Chrome defenses combine model training, origin restrictions, action review, threat detection, and confirmations for critical steps.

One component is the User Alignment Critic. This separate model reviews a planned action and decides whether it serves the user's stated goal. Google says the critic receives action metadata without seeing the unfiltered webpage content that influenced the planner.

That separation reduces the chance that the same malicious text poisons both the planner and its reviewer. The critic can reject a misaligned action or ask the planner to develop another plan.

Google also describes Agent Origin Sets. These limit which websites an agent can read and which it can modify during a task. A trusted gating function decides whether an origin belongs within the requested workflow.

The design moves toward task-scoped authority. However, it must still determine which origins are legitimately relevant. A shopping, travel, or research request can naturally involve several unfamiliar sites.

Attackers can exploit that ambiguity. A malicious page can present another destination as necessary for completion. False positives also matter because excessive blocking makes the agent less useful.

OpenAI similarly treats prompt injection as a continuing security challenge. Its Atlas security work describes ongoing red teaming and model updates rather than a completed fix.

Microsoft has taken a cautious approach with agentic browser actions. Its public guidance describes restrictions on external application launches, sensitive information entry, and certain high-impact actions. Experimental access also limits exposure while designs evolve.

Confirmations remain valuable, especially before purchases, messages, file transfers, or credential use. Yet a confirmation dialog can fail if it presents the attacker's framing instead of the true consequence.

Users also become conditioned to approve frequent prompts. An autonomous tool loses much of its appeal if every meaningful step demands close manual inspection. A control that users routinely accept offers limited protection.

Detection models face an adversarial race. Researchers can generate new phrasings, encodings, images, and multi-step instructions. A detector trained on yesterday's prompts can miss an instruction expressed through context and implication.

That does not make defenses pointless. Layered controls force attackers to cross several barriers and limit the damage when one barrier fails. The problem is treating any single model, policy, or warning as a sufficient boundary.

The skeptical view also requires care. Zenity's broad statements describe a vulnerability class and several demonstrations, not evidence that every AI browser user has been compromised. Proof-of-concept access does not establish widespread exploitation.

Products also change quickly. Perplexity addressed the browser-side issue disclosed in March, while other vendors continue modifying origin and confirmation controls. A finding against one version should not automatically describe every later release.

Still, the absence of known mass exploitation does not resolve the architectural concern. AI browsers act inside high-value authenticated sessions, and the security community has repeatedly found paths from untrusted content to privileged action.

Enterprises should treat these products as privileged automation, not as ordinary productivity software. Deployment reviews should include the same disciplines used for service accounts, robotic process automation, and administrative tooling.

That means limiting connected services, separating personal and business sessions, disabling unnecessary write access, and monitoring outbound actions. High-impact workflows should retain independent verification outside the agent's own interface.

Three Signals Will Show Whether AI Browsers Are Becoming Safer

The next test is whether vendors can constrain agent authority without reducing autonomous browsing to a supervised demo.

The first signal is task-specific origin enforcement. Browser makers need to show that agents cannot freely move information between unrelated sites simply because both appear in one session.

Independent researchers should repeat cross-origin tests after major releases. A successful defense would prevent an injected instruction from adding a new destination, reading unrelated content, or submitting sensitive information.

This would strengthen the case that AI browsers can preserve core Web boundaries. Continued proof-of-concept theft across updated products would show that origin controls remain too dependent on fallible model decisions.

The second signal is independent confirmation for consequential actions. The strongest design would generate approval information from trusted action metadata, not from the webpage or the planner's narrative.

A useful confirmation should state what data will move, which destination will receive it, and which account will perform the action. It should also block silent escalation from a read-only task into a write operation.

Researchers will test whether malicious content can disguise, suppress, or reframe those warnings. If confirmations consistently expose the real consequence, they will weaken intent-collision attacks. If users still see vague prompts, the protection remains fragile.

The third signal is transparent incident and evaluation reporting. Vendors should publish which attack classes they test, what permissions their agents hold, and which actions always require human approval.

Aggregate pass rates alone will not be enough. Tests need realistic emails, calendar invitations, embedded frames, documents, images, URL components, memory entries, and tool responses. They must also include attacks that support the surface wording of the user's task.

OWASP ranks prompt injection among the central risks for language-model applications. Its prompt injection guidance recommends constraining model behavior, validating outputs, separating external content, and applying least privilege.

Public reporting can reveal whether those principles work in deployed browsers. It can also distinguish architectural progress from the patching of individual demonstrations.

Users do not need to abandon every AI browser feature while this work continues. They should match the agent's authority to the sensitivity of the task.

Summarizing public research carries less risk than operating inside email, banking, cloud storage, or password-management sessions. Separate browser profiles can reduce exposure, although they cannot correct an unsafe agent design.

Organizations should begin with limited accounts and noncritical workflows. They should prevent agents from accessing credentials or local files unless a specific approved task requires that access.

Security teams should also assume that content can be hostile even when its hosting service is trusted. A shared document, calendar event, advertisement, support ticket, or internal message can carry attacker-controlled instructions.

Google News will continue surfacing individual discoveries as researchers test new products. Readers should look past each product name and ask whether the agent could distinguish verified intent from untrusted content.

The decisive evidence will come from repeated independent testing. Can an updated agent reject hostile content, stay within task-specific origins, and expose every consequential action before execution?

Until vendors can answer those questions consistently, zero-click agent hijacking remains more than a temporary bug cycle. It is the cost of giving software broad authority before giving it a dependable way to recognize who is issuing the command.