A vulnerability class, not a patch note
Zenity Labs used its Black Hat USA 2026 slot to disclose PleaseFix, a set of zero-click attacks that work against every major agentic browser the firm tested: Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge. None of these products required the victim to click a link, open an attachment, or approve any explicit action. The agent did the damage on its own, mid-task, while performing exactly the kind of routine work an employee assigns it dozens of times a day, like summarizing an inbox or checking the day's calendar for conflicts.
That framing matters for how CISOs should read this disclosure. This is not a single CVE that a vendor quietly patches next Tuesday and everyone moves on. Stav Cohen, who leads Zenity's AI security research team, put it directly: "The takeaway is not 'there's a bug to patch.' It's that a powerful new insider has appeared inside your environment." Any enterprise that has connected an AI browser to corporate email, file storage, or SaaS tools has already handed that insider standing credentials, and the browser vendors have not shipped a way to revoke that trust selectively.
How Intent Collision hijacks a routine task
The mechanism Zenity calls Intent Collision exploits a design choice common to every agentic browser on the market today: these tools pull in content from multiple sources at once, mix that content together in the model's context window, and act on the combined result without reliably separating what the user actually asked for from what the surrounding content itself contains. When an agent reads an email to summarize it for a busy executive, it also reads any instructions an attacker buried inside that email's body, and the model has no dependable way to tell the two apart before acting.
Cohen's team demonstrated four concrete scenarios at Black Hat to make the risk tangible for a skeptical audience. A poisoned calendar invitation triggered file access and credential theft with no interaction beyond the agent routinely checking the day's schedule. A malicious email caused data exfiltration that reached across Gmail, Slack, X, and Claude in a single chained sequence, moving from inbox to workspace tools automatically. A suspicious social media link redirected an agent into sending phishing messages over WhatsApp on the user's behalf, and a manipulated Amazon order page coerced a shopping assistant into completing a fraudulent purchase without the account owner noticing.
Why this breaks the same-origin assumption
Traditional browser security rests heavily on the same-origin policy: content loaded from one site cannot reach into another site's data or session without explicit, narrow permission. Agentic browsers quietly abandon that boundary the moment they start reasoning across tabs, accounts, and inboxes on the user's behalf, because doing so is the entire point of the product. The agent is, by design, supposed to move information between contexts that a traditional browser would keep firmly separated. That is exactly what makes it useful to a knowledge worker, and exactly what an attacker needs to exploit.
Cohen summarized the core problem in blunt terms that avoid technical hedging: "The agent can't reliably tell the difference between content it was asked to read and hidden instructions buried inside that content." That is a considerably harder problem to solve than a missing input filter or an unescaped string. It means the security boundary enterprises have relied on for two decades of ordinary web browsing does not carry over cleanly to a browser that reads on your behalf, holds your session tokens, and acts with your full access across every connected application.
What enterprises should actually do this quarter
Security teams that have already rolled out AI browsers to knowledge workers should start by inventorying exactly which connectors and permissions those agents currently hold: email, calendar, cloud storage, Slack, and any e-commerce or financial accounts linked for convenience. Every one of those connections is now a viable attack surface that a well-crafted email or calendar invite can reach, regardless of how careful or well-trained the employee happens to be. Least-privilege scoping, applied connector by connector, needs to become the default configuration rather than an afterthought bolted on after a pilot program succeeds.
Treat agentic browser deployments the way a mature security program treats a new class of privileged service account, with full logging on every action the agent takes, alerting tuned to unusual cross-application sequences, and a kill switch that revokes access immediately the moment anomalous behavior surfaces in a monitoring dashboard. Vendors have not shipped a durable fix for Intent Collision because there is no clean, universal patch for a design pattern this fundamental to the product. Until one emerges, the compensating control sits squarely with the enterprise deploying the tool, not with the browser vendor selling it.
The pattern this fits into
PleaseFix lands alongside a growing string of 2026 disclosures showing that prompt injection has moved from theoretical academic concern to operational reality across the entire AI agent stack, from coding assistants to workspace automation tools to now the browser itself. Each disclosure targets a different surface and a different vendor, but the underlying failure repeats with striking consistency: an AI system that cannot reliably separate instructions from data will eventually, given enough exposure, follow the wrong instructions at the wrong moment.
For CIOs weighing agentic browser rollouts against real productivity gains, the calculus needs to include this class of risk explicitly as a line item, not bury it as a footnote in a vendor security questionnaire. The five browsers named in this research are the leading products in the category, not obscure niche tools. If the underlying flaw is genuinely structural rather than incidental, waiting passively for a fix from any single vendor is not a viable interim strategy. Scoped deployments, aggressive behavioral monitoring, and a real willingness to pull back access are the tools available to enterprises today.
