All posts
Scope Drift

PleaseFix: Web Content Steers Five Agentic Browsers

Zenity Labs hijacked five agentic browsers via web content that the agent merely reads, escalating summarize-this into full account takeover

Securityv0 Intelligence Team OWASP: ASI03 sv0 finding: scope_drift
agentic-browsers prompt-injection scope-drift zero-click browser-agent intent-collision

The Incident

On 2026-08-05 at Black Hat USA 2026, Zenity Labs researchers Michael Bargury and Stav Cohen presented “Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover,” extending a class Zenity first disclosed in March 2026 against Perplexity Comet to a five-vendor sweep. The affected products are OpenAI’s ChatGPT Atlas, Anthropic’s Claude in Chrome, Google’s Gemini in Chrome, Microsoft’s Copilot in Edge, and Perplexity’s Comet. No CVE IDs were assigned; Zenity frames the class as design-level and named the underlying pattern “Intent Collision” — the agent has no structural way to distinguish an operator instruction from content it reads while carrying that instruction out.

The demonstrated chains were zero-click and cross-origin. With Claude in Chrome, a request to summarize a Gmail message that contained hidden instructions exfiltrated Gmail data, silently shared the victim’s Google Drive, and took over the victim’s Slack, X, and Claude accounts. With ChatGPT Atlas, an X-post comment drove mass WhatsApp phishing from the victim’s account and an Amazon purchase that Rufus completed to an attacker-controlled shipping address. With Perplexity Comet, a poisoned calendar invitation reached the local filesystem and abused agent-authorized 1Password workflows to steal credentials. Perplexity had patched the specific March 2026 Comet finding prior to public disclosure; the August vendor responses split between mitigation pledges and “intended functionality” characterizations. Independent academic corroboration arrived earlier in the year — Roesner and Kohlbrenner at the University of Washington formally concluded that agentic browsers reduce Same-Origin Policy enforcement to the strength of the agent’s prompt-injection defenses.

MITRE ATT&CK coverage: T1078 — Valid Accounts, T1552 — Unsecured Credentials, T1566.002 — Phishing: Spearphishing Link, T1657 — Financial Theft, T1071.001 — Application Layer Protocol: Web Protocols.

The Authority Path That Failed

The identity that carried execution authority in every demonstrated chain was the browser-embedded AI agent, operating inside the user’s already-authenticated browser session. The scope that identity held was the union of every origin the user had logged into: mail, cloud storage, chat, social, e-commerce, password manager, and — in Comet — the local filesystem. The scope that identity exercised on the operator’s request was narrow: “summarize this email,” “accept this meeting,” “look at this X post.” The gap between the two was the target the attackers walked through. Because the agent’s tool inventory had no per-origin or per-action consent gate, a single successful prompt injection collapsed the difference: reading the attacker’s message was categorically equivalent to acting inside every other tab.

The trust anchor that failed first was the assumption that the agent could distinguish an operator’s instruction from content it reads while carrying that instruction out. There is no cryptographic, structural, or provenance-based signal in the agent’s input that separates “this sentence came from the user” from “this sentence came from an email you were told to summarize.” Zenity’s “Intent Collision” name is that failure literally. The University of Washington paper by Roesner and Kohlbrenner reaches the same conclusion from the browser-security direction: the Same-Origin Policy no longer holds when the agent can act inside every origin simultaneously, so its ability to keep origins separate reduces entirely to its prompt-injection resistance — which is not a security boundary anyone should defend against a determined web attacker.

SecurityV0 Perspective

This is a textbook scope_drift finding (ASI03). The agent’s held scope — the union of authenticated origins in the user’s browser session — is orders of magnitude larger than the intent scope of any single request, and the gap between held and exercised is exactly what an attacker who controls any readable content in the tab can steer. The pattern is the same one seen in enterprise agent deployments where an “analyze this ticket” request drifted into “publish to the forum” (the Meta rogue-agent precedent): a benign narrow ask, an agent identity with broad authenticated reach, and no per-action consent gate between them.

What To Do

  • Inventory the tool surface of every agentic browser your team uses, per user. Enumerate the origins the agent can act inside (mail, chat, social, drive, payments, password manager) and the local resources it can reach (filesystem, keychain, 1Password or native credentials). For Comet, Atlas, Claude in Chrome, Gemini in Chrome, and Copilot in Edge specifically, treat that inventory as the pre-authorization surface — anything on it that a user did not explicitly sign off on is a scope_drift risk waiting for the first successful injection.
  • Require a per-action consent gate for cross-origin authenticated actions. Configure the agent so that “share a Drive document,” “send a WhatsApp message,” “post to Slack,” “checkout on Amazon,” and “read from 1Password” each require a fresh user confirmation with the destination, the payload, and the calling origin surfaced literally — not an approval that persists across a session.
  • Segregate the authenticated browser profile the agent runs in from the profile that holds high-value accounts. Run the agentic browser in its own Chrome or Edge profile with only the accounts the current task needs signed in. Do not leave Google Drive, 1Password, Amazon one-click, and WhatsApp Web signed in as ambient authority in the same profile the agent operates.
  • Log every tool call the agent makes with the origin of the content that triggered it. At minimum, retain agent identity, tool called, destination origin, target account or resource, and the source origin of the content chunk that was in context when the tool decision was made. Without that record, “did the agent do this because I asked, or because an email told it to?” has no deterministic answer after the fact.
  • Rotate credentials for accounts an agentic browser has touched during any incident window. OAuth tokens issued to Google Workspace, Slack, X, Claude, and Amazon, plus password-manager sessions the agent could reach, should be revoked and reissued; sharing links the agent may have created should be audited and revoked; recent Amazon orders should be reviewed for attacker-controlled shipping addresses.

Sources

All posts