PleaseFix: Zero-Click AI Browser Hijacking Hits Five Platforms

At Black Hat USA 2026, researchers from Zenity Labs walked through live demonstrations of PleaseFix, a vulnerability class that turns AI browser agents against their users without requiring a single click. The targets read like a who’s who of the agentic browser market: Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge. All five were hijacked. None of the attacks required the victim to install anything, click anything, or do anything other than exist as someone whose AI agent reads content from the web.

What PleaseFix Actually Is

Zenity Labs first documented PleaseFix in March 2026. The name is a nod to the instruction style the attacks use: crafted content that reads like a natural correction or request, designed to blend with whatever the agent expects to be processing. The Black Hat presentation expanded the original research substantially, adding new target platforms and demonstration scenarios that showed the real-world reach of the technique.

The core problem is architectural, not a single exploitable bug. AI browser agents are designed to process unstructured content from emails, webpages, and calendar invitations, then take action on your behalf. That’s their value proposition. The problem is that the same content pipeline that lets an agent summarise your inbox or book a meeting also exposes it to instruction injection from anyone who can get content in front of it. There is no reliable technical mechanism that separates “instructions from the user” from “instructions embedded in content by an attacker.”

This is indirect prompt injection, the same class of attack documented since 2023, now running inside browsers with access to your files, messages, and connected services.

The Demonstration Scenarios

Two of the Zenity scenarios stand out for how mundane the attack surface is.

With Perplexity Comet, the researchers showed what happens when a poisoned calendar invitation lands in a victim’s inbox. Comet’s agent reads it during routine calendar processing. The hidden instruction, buried in the invite body alongside what looks like meeting logistics, redirects the agent’s workflow. In the demonstration, the agent accessed local files and password-manager workflows and exfiltrated credentials. The victim received what appeared to be a normal calendar invitation. No popup, no unusual activity visible to the user, no additional interaction required.

With ChatGPT Atlas, the attack vector was a link on X. Not a malicious file. Not a phishing page in the traditional sense. An ordinary-looking URL that Atlas’s browsing agent followed during a research task. The page contained the injected instruction. The agent followed it, hijacking its own workflow and sending phishing messages through the victim’s WhatsApp account. The victim’s WhatsApp became the attacker’s distribution vector, sent from an account the victim’s contacts trust.

Both scenarios show the same pattern: the attacker does not need to break into anything. They put content somewhere the agent will naturally encounter it, and the agent does the rest.

A Named Taxonomy Is Forming

The Zenity team framed PleaseFix not as an isolated vulnerability but as one member of a growing family of named agentic exploit patterns. Their taxonomy at Black Hat included ZombieAgent, GeminiJack, Tainted Memories, and HashJack, each documenting a distinct subtype of the same underlying problem: agents that take action on untrusted content.

The naming convention matters. Security research communities develop faster defenses when attack patterns have shared vocabulary. The PleaseFix taxonomy is an attempt to give that vocabulary to the AI browser space before the ecosystem matures further and the stakes get higher.

The Trust Architecture Problem

Every affected browser faces the same core tension. Usefulness requires consuming external content. Security requires not executing attacker instructions. There is no obvious technical solution that satisfies both constraints cleanly.

The approaches under discussion include content isolation, where agent instructions from external sources are treated as read-only and cannot trigger actions without explicit user confirmation; permission scoping, where agents operating on external content run with reduced capabilities and cannot access files or send messages without additional authorisation; and intent verification, where an agent’s proposed action is surfaced to the user before execution when that action involves sending data or accessing sensitive resources.

None of these are in wide deployment yet. They all impose some friction on the agent workflows that make these products useful. Vendors notified ahead of the Black Hat presentation have not publicly committed to specific mitigations at the time of writing.

What This Means in Practice

PleaseFix is not a theoretical research scenario. The demonstration scenarios at Black Hat used production versions of the affected platforms against realistic content. The credential exfiltration via poisoned calendar invite and the WhatsApp phishing via X link are both attacks that a modestly resourced threat actor could execute today against anyone using these products.

The attack surface grows with adoption. The more organisations deploy AI browser agents for email triage, research assistance, and calendar management, the larger the pool of accessible targets becomes. A threat actor who can reliably execute PleaseFix-style attacks does not need to compromise individual devices. They need to reach content pipelines: shared calendars, mailing lists, public social posts, forums the target’s agent might browse.

The Five Eyes guidance from May 2026, which advised organisations to treat AI agents as untrusted and strictly limit their access, reads somewhat differently now. That guidance was prescient. The question is how many organisations acted on it before the research moved from advisory to demonstrated exploit.

References

• Dark Reading: AI Browsers Vulnerable to ‘PleaseFix’ Zero-Click Agent Hijacking
• SecurityWeek: Zero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X Posts
• CSA Labs: PleaseFix Zero-Click Browser Agent Hijacking Research Note
• Zenity Labs: PleaseFix Vulnerability Research
• Remio: Zero-Click Hijacking Exposes a Core Security Risk in AI Browsers