The AI-agent specialized security company Zenity has disclosed a vulnerability family called PleaseFix, which hijacks five AI-powered browsers without any clicks from users. Affected are Claude in Chrome, Gemini in Chrome, ChatGPT Atlas, Perplexity Comet, and Copilot Edge. Zenity demonstrated the attacks on August 5th at the Black Hat USA security conference.
Prepared content hijacks user intent
The vulnerability family referred to as PleaseFix exploits the fact that agent-based browsers autonomously read emails, calendar invitations, and web pages to perform tasks on behalf of users. Zenity calls the fundamental problem “Intent Collision”: the systems do not reliably distinguish between user instructions and text that they encounter while browsing. Hidden commands in an email or a comment are sufficient to redirect the agent to a foreign target – entirely without clicks, confirmation, or visible warning signals for the affected person.
In a research report, Zenity describes how four built-in protection layers of ChatGPT Atlas were bypassed in succession: a classifier for page content, a filter against prompt injection, a check for sensitive websites, and a confirmation lock before critical actions. One hard limit held firm – a purchase block at the code level could not be bypassed directly. Instead, the researchers circumvented this by having Amazon’s own assistant Rufus complete the purchase. As early as July, a previous isolated vulnerability in Claude for Chrome had become known, according to The Hacker News – an indication that attacks on agent-based browsers are not an isolated incident.
From Gmail theft to purchases in someone else’s name
In Claude in Chrome, a single prepared email triggered a chain reaction: the agent read the affected person’s Gmail inbox, shared their Google Drive folder with attackers, and subsequently enabled access to Slack and X accounts. In ChatGPT Atlas, a planted comment in an X thread was enough to turn a harmless request – such as signing up for a newsletter – into phishing messages sent to all of the victim’s WhatsApp contacts. In a second case, Atlas filled an Amazon shopping cart, changed the delivery address to that of the attacker, and completed the purchase through Rufus, Amazon’s in-house shopping assistant.
Other attack chains documented by Zenity extend to the takeover of accounts at 1Password, GitHub, and AWS, as well as, in some cases, extensive control over the affected person’s computer via access to local network services. The common denominator of all chains is the same web agent that has simultaneous access to the inbox, cloud storage, and password management. Independent confirmation of these further cases by third parties is still pending.
Manufacturers respond inconsistently to the report
According to Zenity, the findings were reported in stages between December 2025 and March 2026 to Anthropic, Google, Microsoft, OpenAI, and Perplexity, before presenting the full scope at Black Hat. OpenAI acknowledges “significant risks,” according to SecurityWeek, but refers to the fundamental operation of agent-based browsers and has not yet provided a patch. Anthropic classified the report as not eligible for its own bug bounty program. Some manufacturers made targeted improvements, while others described the documented behavior as an intended feature. Co-founder and CTO Michael Bargury puts it succinctly: “Agent-based browsers trade decades of security architecture for convenience.”
The timing hits OpenAI at a sensitive point: the standalone Atlas browser is already being shut down on August 9th, but its functions are being migrated to a Chrome extension and a planned cloud browser – so the underlying class of vulnerabilities does not disappear with the shutdown. AI agents are also deeply integrated into Chrome at Google, for example through automated bug fixing in the source code.
It remains to be seen whether the providers will architecturally solve the fundamental problem or continue to patch individual attack chains one by one. According to Zenity, the circumvention of protection layers can be reproduced with new formulations after each patch, as long as agents process user instructions and foreign text from the same source.
