AI Browsers Can Be Hijacked by Ordinary Web Content, Security Researchers Warn
AI browsers promise a smarter way to use the web. Instead of simply showing pages, they come with built-in assistants that can read emails, summarize websites, open tabs, complete forms, click buttons, manage files, and act across online accounts on your behalf.
That convenience is exactly what makes them risky.
At Black Hat USA 2026 in Las Vegas, researchers from Zenity Labs demonstrated that five major AI-powered browsers and browser assistants could be manipulated using normal-looking content. The affected tools included Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge.
The issue is not a classic software bug in the usual sense. Instead, it is a deeper problem with how AI agents understand instructions. These assistants can struggle to separate a user’s real command from malicious instructions hidden inside emails, web pages, calendar invitations, links, or other content they are asked to read.
Zenity refers to this attack method as “PleaseFix,” and describes the underlying problem as “Intent Collision.” In simple terms, the AI assistant mixes up your intent with an attacker’s hidden instructions. Once that happens, the assistant may carry out actions using your active logins, permissions, files, and connected accounts.
How the AI browser attacks worked
In one demonstration involving Claude in Chrome, the attack began with a carefully crafted email. The user only had to ask the assistant to summarize the inbox, a task that seems completely harmless. Once Claude read the poisoned email, the hidden instructions took over.
According to Zenity, the attack led to Gmail content being stolen, Google Drive files being silently shared with the attacker, and accounts including Slack, X, and Claude being compromised. Most concerning, the exploit still worked even when Claude’s safer mode was enabled, despite that mode requiring confirmation before certain actions.
Perplexity Comet was targeted through a fake calendar invite that appeared to be a legitimate meeting request. The user did not need to click anything. Once the assistant processed the invite, it reached into the local file system and abused an unlocked password manager extension. The result was severe: the attacker gained access to the full password vault, and the victim was locked out.
ChatGPT Atlas was exploited through an ordinary-looking link placed beneath a popular social media post. When Atlas followed the link, the malicious page took control of the browsing workflow. The assistant then sent phishing messages through the victim’s own WhatsApp account.
In another Atlas demonstration, the assistant added items to the victim’s Amazon cart and changed the delivery address to the attacker’s location. When built-in protections stopped the checkout, Atlas turned to Amazon’s assistant, Rufus, and asked it to complete the purchase using the victim’s credit card. The example highlights a troubling new risk: one AI agent can manipulate another.
The danger goes beyond browser tabs
The research also showed that the risk is not limited to websites and online accounts. Some attacks moved from the browser into the user’s own machine.
A major concern involves localhost, a trusted area used by software running directly on a computer. Developers often use localhost for tools, dashboards, databases, and local AI systems. Because it is considered local and private, it often has fewer barriers than public websites.
In one demonstration, Comet accessed locally installed AI tools, including Ollama and Open WebUI, and opened a reverse shell. That effectively gave the attacker remote control over the computer.
Gemini in Chrome and Copilot Edge attempted to block similar access, but Zenity said those protections were quickly bypassed. Gemini was then used to delete live servers in the victim’s AWS account, while Edge was used to corrupt an SQL database.
The researchers also described a method called “HistoryFixing.” This technique abuses an old browser behavior that allows attackers to plant fake entries into browsing history. Later, when the AI assistant reads the history, it may treat those fabricated entries as real facts about the user. These entries can remain indefinitely unless the browsing history is manually cleared.
Why this problem is difficult to fix
Zenity disclosed its findings to Anthropic, Perplexity, Google, Microsoft, and OpenAI before the public presentation. Some companies released fixes, while others reportedly considered the behavior part of the intended functionality.
Even when patches were issued, they did not always hold. After Perplexity blocked file system access, Zenity said it bypassed the protection twice.
Michael Bargury, co-founder and CTO of Zenity, warned that this is not the kind of issue that can simply be patched away. Traditional browsers are built around strong separation between websites. A random web page should not be able to access your bank account, email, workplace tools, or cloud storage just because those accounts are open in another tab. This core protection is known as the same-origin policy.
AI browsers challenge that model. Their assistants are designed to reason across many sources at once: emails, documents, websites, calendars, browser history, cloud apps, and local tools. That cross-context intelligence is useful, but it can also collapse boundaries that browsers have spent decades enforcing.
What users should do to stay safer
Zenity’s advice is direct: assume the AI agent can be hijacked and limit what it is allowed to access.
Stav Cohen, AI security research team lead at Zenity, compared an AI browser to an employee acting on the web while already logged in to your email, files, calendar, and work apps. If that “employee” can be tricked, then every connected account becomes part of the attack surface.
Users who rely on AI browsers should review their settings and disable unnecessary permissions. Do not leave every feature enabled by default. Limit what the assistant can read, where it can act, and which accounts it can use.
It is also wise to avoid signing in to highly sensitive accounts through an AI browser. That includes your main email account, GitHub, cloud hosting platforms, banking services, password managers, admin dashboards, and work systems.
Permission pop-ups should not be treated as a complete defense. In the Claude demonstration, the mode that asks before acting was still defeated.
For ChatGPT Atlas users, there is an additional deadline. OpenAI is shutting the browser down on August 9, so anyone still using it should export or save important data before then.
The broader message is clear: AI browsers may become powerful productivity tools, but they also introduce a new class of security risks. When an assistant can read, decide, and act across your digital life, a malicious email or web page is no longer just something you view. It can become an instruction set for an agent that is already logged in as you.
