"PleaseFix": Zero-Click Agent Hijacking Across Every Major Agentic Browser

Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge

Zenity Labs presented the full scope of PleaseFix at Black Hat USA 2026, expanding research it first published against Perplexity Comet on March 3, 2026 into a vulnerability class affecting every leading agentic browser. The technique, which Zenity calls "Intent Collision," buries instructions in ordinary content the agent reads; those instructions collide with the user's actual request and redirect the agent to act for the attacker using the user's own identity, permissions, and authenticated sessions. Demonstrated outcomes included data exfiltration, full account takeover through Claude in Chrome, and remote control of the machine, none of which required the user to click, approve, or knowingly execute anything. Vendor response was inconsistent: some patched quickly, others classified the behavior as intended functionality

An agentic browser reads content from one origin and takes authenticated actions against another, which is the same-origin policy inverted rather than enforced. Zenity's framing is that the pattern is structural, not incidental: the property that lets the agent be useful across tabs is the property that lets injected text in one tab spend the user's credentials in another