Agentic Browsers Rewind Web Security by 20 years

News, news analysis, and commentary on the latest trends in cybersecurity technology.

PleaseFix class of flaws makes it easy to socially engineer agentic browsers and highlights weaknesses in how they handle cross-origin requests.

As business users and developers alike tap into agentic browsers to take work off their plates, the very traits that make them useful are also introducing a whole new class of risks. Security researchers warn that to make it easier for agents to reach across different web domains to get things done for the user, agentic browsers have "ripped out" some key security mechanisms from the browser.

Unsurprisingly, this has opened up every commercial agentic browser out in the market to a new arsenal of attack possibilities that ranges from account takeover to full blown browser escape and remote compromise of the underlying system running the browser.

"We found very different designs with different security assurances across these agentic browsers, but the end result is that we can hack each and every one of them," says Michael Bargury, CTO and co-founder of Zenity and one of the lead researchers presenting their findings in a session week at Black Hat.

Zenity researchers dubbed the class of vulnerabilities they'll dive into at BlackHat PleaseFix, in a nod to a well-known attack against browsers that socially engineers users to help attackers get around defenses.

"With browsers, we've had this persistent problem called ClickFix for many, many years where users get convinced to click on something to actually do the malicious action themselves," Bargury says. "Now with AI, we just ask the agent really nicely and it does the thing for us."

Exploiting PleaseFix can be achieved in plain English to achieve zero-click attack chains that hijack of agentic browsers and spiral into RCE. The attacks is triggered by manipulating the agent into interacting with malicious content, including something as trivial as a social media post or sign-up.

"We can take over your social accounts, WhatsAp to all your friends on your behalf, buy thing son your behalf in Amazon, basically everything that you can do through the browser," Bargury says. "But then we have also actually been able to cross from browser to machine and to full RCE. My problem with this talk is we have too much to show—I want to go straight up on stage and show demo after demo after demo."

Back in March, Zenity first introduced PleaseFix when it disclosed a pair of exploits against a flaw it called Perplexed Browser, a flaw in Perplexity Comet. This was the first triggered zero-click agent compromise to gain access to local file sistems and the second made it possible to achieve account takeover against password managers. At the time this was limited to Comet, but it served as a spark for much broader research.

"Since then, we've been going at all of the agentic browsers one-by-one," he says, explaining they've spent considerable time reverse engineering everything from ChatGPT Atlas to Claude for Chrome to understand how security mechanisms have been tinkered with to accommodate autonomous agentic action. They followed this down many rabbit holes to show how rampant PleaseFix flaws really are. "What we are showing in our talk is that this is not just one or two flaws, but is a class of vulnerabilities."

As Zenity researchers explored exploitation of this class of flaws, Bargury says that they looked for creative ways to get around the guardrails that browser developers and AI labs are building into their systems to prevent attack. One of the key methods they'll show off at BlackHat is something that Zenity researcher Stav Cohen calls 'intent collision.' This is when an attacker uses a seemingly benign user request from the agent to cause the agent to stumble into malicious instructions from untrusted content.

Bargury says that PleaseFix is made possible due to some very old-school security problems that traditional browsers had licked many years ago.

"In the last 20 years, there were a lot of lessons learned the hard way securing the browser," he says, explaining that responding to common isues like SSRF and CSRF had the industry come up with a layer cake of mitigations that have served well over the years. One of the most important among them, he says, are cross-origin restrictions that prevent actions taken one site to spill over into another domain.

"So, if I log into Twitter or a blog site, the things done there cannot instruct the browser to now open up a page in my bank account and click on one of the buttons in there to perform an action," he says. "Because the origin is different, one website is not allowed to trigger a request in another site. That is a fundamental security control within browsers and all of these AI agent browsers just removed that."

Zenity researchers aren't the only ones diving into this issue. In April, researchers Franziska Roesner and David Kohlbrenner from the Paul G. Allen School of Computer Science & Engineering at University of Washington published a paper titled " Agentic Browsers And The Same-Origin Policy ." They found that each type of agentic browser handled same origin policy (SOP) differently, as their makers figure out the right balance between agent utlity and fundamental security controls

"The most restrictive agentic browsers provide only limited information a webpage to the agent in a predefined prompt format, while most of the least restrictive systems are full-fledged browser use agents that 'act' like human users," they wrote in the paper. "While the former approach severely limits the utility of browser agents, the latter approach undermines decades of work in browser security."

Bargury also notes that one of the other problems with less restrictive agentic browsers is that they're replacing strict, deterministic security controls with non-deterministic systems with classifiers that "try really, really hard to see if something is a problem." He says that inevitably these non-deterministic systems fail some percentage of the time.

"You are replaingi guarantees that needed a vulnerability to bypass them with something that's not a guarantee," he says, explaining that performing browser escape is made infinitely easier because "we just need to now bypass these non-deterministic systems."

While Bargury says that his team's research found it was able to exploit every agentic browser on the market, like the UW researchers they found that every one of them had different architectural approaches and different guardrails that exposed them to attacks in different ways. "It's not that one is better than any other. They're just different and they're protected at different levels," he says, explaining that at the show and in the weeks beyond his team will be releasing technical information that can help security decision-makers better threat model the different browsers based on their needs.

He also hopes the talk will help security pundits and security leaders at different organizations to pressure browser developers to provide more visibility into how these agentic browsers operate.

"Agentic browsers are black boxes. You don't know what's inside, you don't get logs, and you don't get chain of thought," he says. "I think that is not acceptable for an enterprise-wide deployment."

He's hoping the pressure can get AI labs to pen up the telemetry just as many of them have done for coding agents.

In the meantime, his suggestions for users and security policy makers who still want to reap the benefits of agentic browsers is to use an isolated set of credentials to operate them.

"If you log in with your own credentials at this point, I am not sure you're going to have a good day," he says, explaining the way to go is have a whole different set of email accounts, separate calendar invites, and separate credentials that are isolated for the purpose of agentic browsing.

Aug 1, 2026 TO Aug 6, 2026

Mandalay Bay Convention Center, Las Vegas, USA

The premier cybersecurity event of the year returns to Mandalay Bay with a re‑engineered, six‑day program built to ignite innovation, push boundaries, and bring the global security community together like never before. This year’s event features four days of immersive, expert‑led Trainings (August 1–4), followed by Summit Day on Tuesday, August 4, and a two‑day main conference packed with groundbreaking Briefings, open‑source tool demos in Arsenal, a dynamic Business Hall, and unlimited learning & networking opportunities. Use code: DARKREADING to save $200 on a Briefings pass or $100 on a Business pass.

Contributing Writer, Dark Reading

An award-winning freelance reporter with nearly two decades of experience covering B2B cybersecurity, Ericka Chickowski has tackled every angle of security and risk for Dark Reading since 2009. Her coverage has spanned the full range of cyber topics important to every kind of cybersecurity stakeholder, including cybersecurity practitioners, CISOs, security-minded business managers, and security-aware board directors. She specializes in going deep on topics, breaking down how the technology trends affect real people, and how risk impacts the bottom line.

Some special areas of focus include: adversarial AI; AI risk and resilience; AI and agentic governance; application security (AppSec); governance, risk, and compliance (GRC); cloud security; network security; software supply chain risk; cyberinsurance; DevSecOps; enterprise risk management; and CISO career development.

In addition to Dark Reading, Ericka has written for many different IT and business publications over the years. Her byline has appeared in dozens of trade and consumer magazines, including Baseline, Consumer Digest, Channel Insider, CIO Insight, CSOOnline.com , DevOps.com, eWeek, Entrepreneur, Forbes, InformationWeek, SC Magazine, and SecurityBoulevard . She regularly contributes independent stories AppSec and supply chain risk to the ReversingLabs Blog. She was one of the founding contributing editors for DevOps.com and has deep expertise in digital transformation and development best practices. This helps inform her stories on software risks and business resilience.

Ericka is also a prolific executive ghost writer, with experience helping cybersecurity and IT leaders bring their ideas to life. She's helped them craft important position pieces for respected publications like the Financial Times and The Wall Street Journal .

Prior to beginning her freelance career, Ericka served in a number of editorial staff roles, including West Coast Bureau Chief for SC Magazine . Before that position, she was editor-in-chief for a cluster of regional technology and lifestyle magazines in the Seattle area, as well as a beat reporter for a regional business newspaper. She holds a bachelor's degree in English from the University of Washington. Her work is well-regarded and has won multiple awards from the Society of Professional Journalists.

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Experts Explain How to Develop a Framework for Cyber-Fraud Fusion

Prevention at Machine Speed: Hunting Beyond Known Detections

0-Day to 10x Discovery: Security at the Speed of Mythos

When AI Becomes an Insider: Rethinking Risk in Critical Infrastructure

Governing the Agent; Identity Security in the Age of Autonomous AI