Zero-Click Agent Hijacking: What the PleaseFix Vulnerability Class Reveals About Agentic Browsers

At Black Hat USA on August 5, 2026, Zenity Labs disclosed a vulnerability class called PleaseFix that hijacks five major agentic browsers, Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge, with zero user interaction required. Researchers demonstrated exfiltrating email, sharing cloud drive contents, draining password vaults, and gaining remote machine control, all without a single click from the person whose browser it was.

Why this is a class, not a bug

The root cause isn't a coding mistake sitting in one vendor's implementation. Agentic browsers work by letting an AI assistant read and act across whatever page it's looking at, which requires deliberately dismantling the Same-Origin Policy, the decades-old browser security boundary that keeps one site from reading another site's data. Once that boundary is relaxed so an agent can act cross-site on your behalf, the assistant loses the ability to reliably distinguish a command you typed from a hidden instruction planted in content it merely read. That's not an implementation detail you can patch away, it's the tradeoff every agentic browser vendor made to enable the feature in the first place.

Academic research on this exact pattern, funded by NSF and Schmidt Sciences, formalizes it as a time-of-check-time-of-use vulnerability: the agent verifies something is safe, then acts on it later, and the gap between those two moments is where an attacker plants a change. This is a known, named category of vulnerability in security research generally, applied here to a product category that's barely two years old.

The response split tells you something too

Vendor reactions to the disclosure didn't converge. Some pledged mitigations. Others effectively framed cross-origin agent access as intended functionality rather than a flaw, which is a legitimate position (the feature doesn't work at all without that access) but also means there's no industry consensus yet on what "fixed" would even look like. This isn't a CVE you patch and move on from, it's an open architectural debate that's going to keep producing incidents like this one until the industry agrees on a boundary model that doesn't just recreate the Same-Origin Policy problem under a different name.

It's also not isolated to browsers. CVE-2026-25253, the first CVE ever assigned to an agentic AI system, involved remote code execution in a skill runtime via a crafted package, and was followed by a campaign that published over 1,200 malicious skills to an agent marketplace in a two-month span. The pattern, an AI agent given broad execution ability, trusting content it wasn't built to treat as adversarial, extends well past the browser.

What this means before you grant browser-level access

If you're evaluating an agentic browser or a similar tool for a workflow that touches sensitive systems, email, cloud storage, credentials, treat the access grant the same way you'd treat handing someone your unlocked laptop, not the way you'd treat a read-only dashboard. Ask specifically what the vendor's response to PleaseFix-class attacks has been, whether it's a real architectural mitigation or a policy statement, and scope what the agent can actually reach as narrowly as the workflow allows. The vulnerability class isn't going away because a vendor issued a statement about it.