By At Black Hat USA 2026, Zenity Labs demonstrated that every major AI browser developers are actively using — Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, Copilot in Edge — can be fully hijacked without a single user click. No phishing link. No malware download. One malicious email that the agent reads during a routine “summarize my inbox” request is enough to exfiltrate your Gmail, silently share your Google Drive with an attacker, and hand over your Slack and X accounts. Zenity named the vulnerability class PleaseFix. The name is deliberate. Browser vendors cannot fully fix this.
The Problem Is Architectural
Agentic browsers work by letting a built-in AI agent reason across multiple data sources simultaneously — your email, open tabs, connected documents, calendar — in a single session. That cross-context reasoning is the product. It is also the attack surface.
Traditional browsers enforce the same-origin policy: content from one domain cannot access resources from another. Agentic browsers discard that boundary. The agent has to read across origins to do its job, and it cannot reliably distinguish between your instructions and instructions injected by an attacker into content it processes. Dark Reading’s assessment is blunt: there is no perfect fix for this class of flaw. The same design choice that makes the product useful makes it structurally exploitable.
What the Black Hat Demo Actually Showed
Zenity co-founder Michael Bargury and researcher Stav Cohen ran a live demonstration. Starting from a single crafted email — formatted to look like normal correspondence — they had the agent silently:
- Exfiltrate the victim’s Gmail inbox
- Share the victim’s entire Google Drive with an attacker-controlled account
- Take over the victim’s Slack, X, and Claude accounts
The user saw nothing. No permission prompt. No unusual behavior. The agent processed the email as part of a routine summarization task and executed every step in the background. Five accounts compromised from one email the user never opened.
PleaseFix Is a Category, Not a Single Bug
The March 2026 disclosure started with Perplexity Comet. The August 2026 Black Hat presentation expanded the scope to every major platform. PleaseFix is now the name for a vulnerability class with multiple confirmed instances:
- ZombieAgent (Radware, January 2026): Targets OpenAI Deep Research. Malicious instructions implanted in ChatGPT memory via emails or document attachments persist across sessions, enabling silent long-term control.
- GeminiJack: Hidden instructions embedded in shared Google Docs are silently retrieved and executed by Google Gemini when users search their workspace, leaking Gmail, Calendar, and Drive data.
- Tainted Memories (LayerX Security, October 2025): A CSRF flaw in ChatGPT Atlas injects persistent malicious instructions into a user’s ChatGPT memory, surviving session resets.
- HashJack (Cato Networks): Zero user interaction required. Specific mechanics undisclosed.
Every major AI browsing platform has a confirmed instance. This is not one vendor’s mistake. It is a structural problem with how agentic browsers are built.
The GitHub Risk Developers Need to Know About Now
The most immediately actionable risk for developers is GitLost, a prompt injection vulnerability discovered by Noma Security in GitHub Agentic Workflows.
GitHub Agentic Workflows allows organizations to run AI agents that automate issue triage and repository management. The agent receives issue titles and body text as direct instructions — without sanitization. An attacker with no credentials and no access to your organization needs only to open an issue on any public repository your org owns. A plausible-looking request in plain English instructs the agent to fetch Readme.md files from private repositories in the same organization and post them as a public comment.
If your organization uses GitHub Agentic Workflows alongside private repositories, this is an active exposure today.
What You Should Do
Bargury’s framework from Black Hat is the right starting point: assume the agent will get hijacked, determine the worst it could do with its current permissions, then remove everything it does not strictly need.
- Apply least-privilege to agent permissions. If the agent does not need Google Drive access for a given task, revoke it before the session starts.
- Isolate agentic browser sessions. Do not use the same browser profile for agentic tasks and authenticated enterprise services.
- Use short-lived credentials only. Never grant agents persistent tokens with broad scope.
- Treat agent-readable content as attacker-controlled. Any email, document, or webpage the agent processes could carry injected instructions.
- GitHub Agentic Workflows users: scope issue triage agents to public repository context only and audit what private resources the agent can access before enabling the feature.
None of these steps eliminate PleaseFix. They limit what an attacker can accomplish after a successful injection. SC Media and the Cloud Security Alliance both recommend treating indirect prompt injection as a first-class threat requiring immediate policy controls — not a future roadmap item.
Agentic browsers reached tens of millions of users before the security model was ready. The fix developers need does not exist yet. The controls listed above are what exists now.
