Attackers can steal data using simple AI browser vulnerability

Attackers can leverage vulnerabilities in AI-powered web browsers to access sensitive files and credentials through a simple calendar invitation.

Security firm Zenity Labs said the newly discovered flaws, collectively named "PleaseFix," affect web browsers built with AI (aka agentic browsers), such as Perplexity’s Comet.

AI browsers are designed to do more than display webpages. They can interpret instructions, remember logged-in sessions and automatically perform tasks across multiple apps and services.

While this automation can improve productivity, it also expands the potential attack surface.

According to Zenity, attackers can exploit the vulnerabilities by embedding malicious instructions inside routine content, such as a calendar invite.

If a user accepts the invitation, the AI browser can be manipulated through a prompt injection attack. Attackers can then trick it into performing actions on the user's behalf, without their knowledge.

This is similar to the vulnerability seen in Anthropic’s Claude Desktop extensions last month , which used Google Calendar as an attack path.

Zenity researcher Stav Cohen said the attack does not rely on traditional malware or software bugs. Instead, it takes advantage of how AI agents interpret instructions and execute tasks.

In a demonstration by the researchers, the injected instructions directed the browser to access the user's local file system, browse directories and read files.

The system could then exfiltrate the data to an external server.

Because agentic browsers often operate with the user's authenticated context, attackers are also able to manipulate connected services.

In one case described by Zenity, the browser could access a logged-in password manager and silently extract stored secrets or change account settings.

Prompt injection attacks work because many AI systems struggle to distinguish between commands issued directly by users and instructions embedded within external content.

That means emails, webpages or documents can act as hidden prompts if phrased in a way the AI interprets as a task request.

Traditional web browsers require explicit user approval before accessing sensitive resources such as local files. However, agentic browsers are designed to infer the actions necessary to complete a task, allowing them to perform certain operations automatically.

Zenity warned that this autonomy effectively extends the user's trust to automated workflows that current security tools may not fully monitor.

"This is not a bug. It is an inherent vulnerability in agentic systems," said Michael Bargury, co-founder and CTO of Zenity.

"Attackers can push untrusted data into AI browsers and hijack the agent itself, inheriting whatever access it has been granted. This is an agent trust failure that exposes data, credentials and workflows in ways existing security controls were never designed to see."

The vulnerabilities were reported to Perplexity last year, according to Zenity, and a fix for Comet was released in February 2026.

Security experts say the findings indicate broader challenges facing developers building AI-driven software.

In December, OpenAI warned that prompt injection vulnerabilities are "unlikely” to ever be completely eliminated in agentic systems, though risks could be reduced through stronger safeguards, automated attack detection and adversarial testing.

The issue has already attracted attention from the wider cybersecurity community.

Last year, security firm Check Point reported discovering malware designed specifically to manipulate AI-based security tools by embedding natural-language instructions intended to trick them into misclassifying malicious code as safe.

Researchers say the PleaseFix vulnerabilities demonstrate how similar techniques could be used against AI assistants embedded directly in everyday software.