Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Research demo

PleaseFix at Black Hat USA 2026: a 0-click takeover vulnerability class across Claude in Chrome, Comet and Atlas

AIR-2026-0196 AIR record · 2026-08-zenity-pleasefix
Open in dashboard About
From the supporting source
Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeoverzenity.io
The record
Disclosed
2026-08-12
Vendor
Anthropic; Perplexity; OpenAI
Product
Claude in Chrome; Perplexity Comet; ChatGPT Atlas
Risk domain
Privacy › Data exfiltration channels
Also touches
Credential theft, Privilege escalation, Confused deputy
System type
Generative model
Who acted
Agent acted — the browser agents took over the live accounts with zero clicks
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection web content
Impact type
Account takeover, Data exfiltration, Credential theft, Agent hijack, Remote code execution
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI02 – Tool Misuse and Exploitation
MITRE ATLAS
AML.T0024 – Exfiltration via AI Inference API
NIST AI RMF
MAP 4.2
EU AI Act
Article 10
ISO/IEC
TR 24028; 23894
AIUC-1
A. Data & Privacy
Scope
tool misuse
Mitigation
Monitor network traffic for anomalous patterns; Restrict egress destinations.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
flagship agentic browsers across three vendors
Capability abused
authenticated_browsingcross_site_actionsession_accesspage_content_ingestionlocal_file_accesspassword_manager_workflowcross_domain_authenticated_actioncontent_ingestionlocal_code_execution_in_some_products
Defense & remediation
Recorded defense
per-vendor agentic-browser safety classifiers
Guardrail kinds
Input classifier
Guardrail outcome
Silent
Fix shipped
Mixed: some vendors patched, others declined, characterizing the findings as intended functionality
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI05 Unexpected Code Execution (RCE)OWASP ASI03 Identity and Privilege Abuseconference_demoagentic_browserzero_clickvulnerability_classover_agencybrowser_agentintent_collisioncross_vendorarchitectural_not_patchable
Curator notes
Michael Bargury and Stav Cohen (Zenity), Black Hat USA 2026 briefing; Stav Cohen also presented it at DEF CON 34 AI Village on 9 Aug 2026. Zenity's recap (12 Aug 2026) describes '0-click attacks against flagship agentic browsers that achieved account take[over]'. Umbrella record for the Grand Theft Atlas and Claude in Chrome writeups, which are the per-product detail. Sibling briefing: 'Promptware EOD: Skillful Agent Detonation' (Bargury, Sharbat) on malicious agent skills. | Merged from duplicate id `2026-08-blackhat-pwning-agentic-browsers-pleasefix`. Also reported under the titles: 'PleaseFix: zero-click exploit chains across five agentic browsers'; 'PleaseFix: Intent Collision is a zero-click vulnerability class across Claude in Chrome, Gemini in Chrome, Comet, Atlas and Copilot Edge'.
Supporting sources
Cite as
Enkrypt AI. "PleaseFix at Black Hat USA 2026: a 0-click takeover vulnerability class across Claude in Chrome, Comet and Atlas". AIR, AIR-2026-0196. https://agentincident.vercel.app/i/AIR-2026-0196/ (accessed 2026-10-19).