Informa TechTarget | SearchSecurity Cybersecurity Dive InformationWeek Channel Dive Explore our brands Dark Reading Resource Library Black Hat News Omdia Cybersecurity Advertise NEWSLETTER SIGN-UP Cybersecurity Topics World The Edge DR Technology Events Resources ENDPOINT SECURITY News, news analysis, and commentary on the latest trends in cybersecurity technology. Agentic Browsers Rewind Web Security by 20 years PleaseFix class of flaws makes it easy to socially engineer agentic browsers and highlights weaknesses in how they handle cross-origin requests. Ericka Chickowski,Contributing Writer,Dark Reading July 27, 2026 7 Min Read SOURCE: ROBERT AVGUSTIN VIA SHUTTERSTOCK As business users and developers alike tap into agentic browsers to take work off their plates, the very traits that make them useful are also introducing a whole new class of risks. Security researchers warn that to make it easier for agents to reach across different web domains to get things done for the user, agentic browsers have "ripped out" some key security mechanisms from the browser. Unsurprisingly, this has opened up every commercial agentic browser out in the market to a new arsenal of attack possibilities that ranges from account takeover to full blown browser escape and remote compromise of the underlying system running the browser. "We found very different designs with different security assurances across these agentic browsers, but the end result is that we can hack each and every one of them," says Michael Bargury, CTO and co-founder of Zenity and one of the lead researchers presenting their findings in a session next week at Black Hat. Related:Agentic AI Challenges Progress in Confidential Computing PleaseFix Simplifies Socially Engineering AI Agents Zenity researchers dubbed the class of vulnerabilities they'll dive into at BlackHat PleaseFix, in a nod to a well-known attack against browsers that socially engineers users to help attackers get around defenses. "With browsers, we've had this persistent problem called ClickFix for many, many years where users get convinced to click on something to actually do the malicious action themselves," Bargury says. "Now with AI, we just ask the agent really nicely and it does the thing for us." Exploiting PleaseFix can be achieved in plain English to achieve zero-click attack chains that hijack of agentic browsers and spiral into RCE. The attacks is triggered by manipulating the agent into interacting with malicious content, including something as trivial as a social media post or newsletter sign-up. "We can take over your social accounts, WhatsAp to all your friends on your behalf, buy thing son your behalf in Amazon, basically everything that you can do through the browser," Bargury says. "But then we have also actually been able to cross from browser to machine and to full RCE. My problem with this talk is we have too much to show—I want to go straight up on stage and show demo after demo after demo." Back in March, Zenity first introduced PleaseFix when it disclosed a pair of exploits against a flaw it called Perplexed Browser, a flaw in Perplexity Comet. This was the first triggered zero-click agent compromise to gain access to local file sistems and the second made it possible to achieve account takeover against password managers. At the time this was limited to Comet, but it served as a spark for much broader research. Related:Two-Factor Authentication Breaks Free From the Desktop "Since then, we've been going at all of the agentic browsers one-by-one," he says, explaining they've spent considerable time reverse engineering everything from ChatGPT Atlas to Claude for Chrome to understand how security mechanisms have been tinkered with to accommodate autonomous agentic action. They followed this down many rabbit holes to show how rampant PleaseFix flaws really are. "What we are showing in our talk is that this is not just one or two flaws, but is a class of vulnerabilities." As Zenity researchers explored exploitation of this class of flaws, Bargury says that they looked for creative ways to get around the guardrails that browser developers and AI labs are building into their systems to prevent attack. One of the key methods they'll show off at BlackHat is something that Zenity researcher Stav Cohen calls 'intent collision.' This is when an attacker uses a seemingly benign user request from the agent to cause the agent to stumble into malicious instructions from untrusted content. "Instead of trying to hit the guardrails directly to tell the model, 'Hey, do something malicious,' we are not going to do prompt injection at all," Bargury explains. "We are just going to convince the agent, the model that what the user wants is achievable through our goal. If the user asked to sign up to a newsletter, I will specify that signing up to a newsletter means getting me a reverse shell on your machine. I don't fight the original intent. I just nudge it in my direction." Related:Microsoft's Original Windows Secure Boot Certificate Is Expiring Moving Backward on Browser Security Bargury says that PleaseFix is made possible due to some very old-school security problems that traditional browsers had licked many years ago. "In the last 20 years, there were a lot of lessons learned the hard way about securing the browser," he says, explaining that responding to common isues like SSRF and CSRF had the industry come up with a layer cake of mitigations that have served well over the years. One of the most important among them, he says, are cross-origin restrictions that prevent actions taken one site to spill over into another domain. "So, if I log into Twitter or a blog site, the things done there cannot instruct the browser to now open up a page in my bank account and click on one of the buttons in there to perform an action," he says. "Because the origin is different, one website is not allowed to trigger a request in another site. That is a fundamental security control within browsers and all of these AI agent browsers just removed that." Zenity researchers aren't the only ones diving into this issue. In April, researchers Franziska Roesner and David Kohlbrenner from the Paul G. Allen School of Computer Science & Engineering at University of Washington published a paper titled " Agentic Browsers And The Same-Origin Policy." They found that each type of agentic browser handled same origin policy (SOP) differently, as their makers figure out the right balance between agent utlity and fundamental security controls "The most restrictive agentic browsers provide only limited information about a webpage to the agent in a predefined prompt format, while most of the least restrictive systems are full-fledged browser use agents that 'act' like human users," they wrote in the paper. "While the former approach severely limits the utility of browser agents, the latter approach undermines decades of work in browser security." Bargury also notes that one of the other problems with less restrictive agentic browsers is that they're replacing strict, deterministic security controls with non-deterministic systems with classifiers that "try really, really hard to see if something is a problem." He says that inevitably these non-deterministic systems fail some percentage of the time. "You are replaingi guarantees that needed a vulnerability to bypass them with something that's not a guarantee," he says, explaining that performing browser escape is made infinitely easier because "we just need to now bypass these non-deterministic systems." Lessons Learned While Bargury says that his team's research found it was able to exploit every agentic browser on the market, like the UW researchers they found that every one of them had different architectural approaches and different guardrails that exposed them to attacks in different ways. "It's not that one is better than any other. They're just different and they're protected at different levels," he says, explaining that at the show and in the weeks beyond his team will be releasing technical information that can help security decision-makers better threat model the different browsers based on their needs. He also hopes the talk will help security pundits and security leaders at different organizations to pressure browser developers to provide more visibility into how these agentic browsers operate. "Agentic browsers are black boxes. You don't know what's inside, you don't get logs, and you don't get chain of thought," he says. "I think that is not acceptable for an enterprise-wide deployment." He's hoping the pressure can get AI labs to pen up the telemetry just as many of them have done for coding agents. In the meantime, his suggestions for users and security policy makers who still want to reap the benefits of agentic browsers is to use an isolated set of credentials to operate them. "If you log in with your own credentials at this point, I am not sure you're going to have a good day," he says, explaining the way to go is have a whole different set of email accounts, separate calendar invites, and separate credentials that are isolated for the purpose of agentic browsing. Black Hat USA AUG 1, 2026 TO AUG 6, 2026 | MANDALAY BAY CONVENTION CENTER, LAS VEGAS, USA The premier cybersecurity event of the year returns to Mandalay Bay with a re‑engineered, six‑day program built to ignite innovation, push boundaries, and bring the global security community together like never before. This year’s event features four days of immersive, expert‑led Trainings (August 1–4), followed by Summit Day on Tuesday, August 4, and a two‑day main conference packed with groundbreaking Briefings, open‑source tool demos in Arsenal, a dynamic Business Hall, and unlimited learning & networking opportunities. Use code: DARKREADING to save $200 on a Briefings pass or $100 on a Business pass. GET YOUR PASS Read more about: Black Hat News About the Author Ericka Chickowski Contributing Writer, Dark Readi