The Browser That Runs Errands for You Can Be Told to Rob You. Patching One Never Closes the Rest.
One team demonstrated the same attack against five companies' AI browsers this month. The vendors themselves say it may never be fully solved. Here is what that means for you.
In the spring, over coffee, a friend asked whether the new AI browsers were worth installing — the ones that don't just show you a page but go off and do things on it. I said yes, and then I kept talking, which is where the trouble started.
I'd spent a week letting one reconcile a stack of receipts I had been avoiding since January. It was good. Embarrassingly good. So I went past the question she asked and told her to sign it in to everything — mail, calendar, the airline account, the lot — because an assistant that cannot see your accounts cannot do anything useful for you.
The first half I still believe. The second half was advice I had no business giving. My error wasn't underrating the privacy risk; it was hearing a privacy question and answering it, when what she had actually asked, without either of us noticing, was a question about authority. Not what can this see? but who is allowed to give it orders?
The answer, it turns out, is: any web page it reads.
Eleven days ago, five companies' browsers went down to the same technique
On August 5, 2026, at Black Hat USA, the research group Zenity Labs presented a class of attack it named PleaseFix. Its own announcement describes zero-click exploit chains across Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Copilot Edge — five agentic browsers, five companies, five security teams, one technique. Covering the talk independently, the Israeli business daily Calcalist reported that the researchers showed how attackers can manipulate AI agents into stealing information, taking over accounts and even gaining control of users' devices, without requiring a single click.
Two caveats before you panic. These are researcher demonstrations, not a body count — no source I can verify reports real people robbed this way by an agentic browser — and the vendors were told first, some holes closed before the talk.
Now the part that should still bother you: it is not that one of the five failed. It is that all five did, and not through sloppiness at any of them.
The one sentence that explains the whole mess
The US National Institute of Standards and Technology, the federal body that writes the country's security taxonomies, puts the cause in one clause: generative models combine the data and instruction channels, so an attacker can use the data channel to affect how the system operates.
Unpack that, because it is the whole article. In ordinary software there is a wall between a program's instructions and the material it works on: your word processor never mistakes a sentence you typed for a command to wipe your drive. Thirty years of engineering built that wall. A language model doesn't have one. As the security nonprofit OWASP's 2026 agentic-AI report puts it, the system prompt, your request and whatever the web page happens to say all arrive as a single stream of tokens, with no reliable way to mark some as commands and the rest as data. The same report maps prompt injection to six of the ten categories in OWASP's Top 10 for agentic applications.
So when you tell your browser "summarize this page," you are not asking it to read. You are handing the page's author a microphone in a room where your agent is listening for orders.
The developer Simon Willison gave that configuration a name that stuck: the lethal trifecta — access to your private data, exposure to untrusted content, and the ability to communicate outward. Any two are survivable. All three together, in his words, let an attacker trick the system into taking your data and sending it to them — and we still don't know how to prevent that 100% reliably.
An AI browser is built to have all three at once. That is not a defect in the product. That is the product.
The browser makers know it. When Brave's security team took apart Perplexity's Comet last August, they found it fed page content straight to the model without separating the user's instructions from the untrusted text, and concluded that same-origin policy and CORS are all effectively useless here. Those rules — the ones that stop one website reading another's data in your browser — are load-bearing for the modern internet, and they do not apply when an agent is the one reading the page.
The companies selling these browsers say it out loud
Anthropic writes, in its own research on prompt-injection defenses, that no browser agent is immune to prompt injection — and that even a 1% attack success rate still represents meaningful risk. When it launched its Chrome pilot in August 2025 it published numbers: adversarial testing showed a 23.6% attack success rate without mitigations, cut to 11.2% in autonomous mode with them.
OpenAI's position, reported in December 2025, is that prompt injection is unlikely to ever be fully "solved", and it conceded that agent mode in ChatGPT Atlas expands the security threat surface. That framing crossed the political aisle intact: Fox News covered the same admission under the line that these attacks are not a bug that can be fully patched but a long-term risk. Perplexity's security team calls malicious prompt injection an unsolved problem across the industry. Microsoft's Edge engineers note that researchers, their own included, have published exploits that take control of early agentic browsers, and that the answer is defense-in-depth — layers, not a fix. Its security researchers went further this May: once a model is wired to tools, prompt injection sits on a thin line between a content problem and becoming a code execution primitive.
Read that list again. Every one of those companies ships or supports an agentic browser. None promises you a fix.
So it's manageable, and I'm being alarmist. Right?
Here is the strongest case against everything above. Take it seriously; parts of it are true.
The numbers really are moving. Anthropic's 23.6% fell to 11.2% with mitigations, and by November 2025 the company was writing about a 1% attack success rate — on its own numbers, roughly a twentyfold reduction.
Coordinated disclosure demonstrably works. The best example reads worst in a headline. Zenity's March 2026 write-up on Comet showed an attack in which a benign calendar invitation is sufficient to make the browser walk your local file system. Frightening — and already fixed: Zenity reported it in October 2025, Perplexity classified it critical, and the fix was confirmed effective on February 13, 2026, three weeks before publication. Zenity says the same of this month's research — Perplexity addressed the underlying browser-side agent execution issue prior to public disclosure.
There are designs that hold. A multi-institution team has published design patterns for agents with provable resistance to prompt injection, and the trade is explicit: utility for security.
And regulators are not asking for a ban. Britain's National Cyber Security Centre, warning that prompt injection may never be totally mitigated the way SQL injection was, concludes that the effort should go into reducing risk and impact and driving up resilience, not abandoning the category.
All fair. Here is why "a bug being fixed" is still the wrong frame.
Perplexity shipped an initial patch for that file-access hole in January 2026, and researchers bypassed the fix using a modified file path; a second patch in February restricted file:// access properly. Brave retested after publishing its Comet post and reported that Perplexity still hadn't fully mitigated the kind of attack it described. And when it looked again in October, it found injections in three agentic browsers via text hidden inside images — imperceptible to a human, plain as day to the model — diagnosing the cause not as a bug list but as a failure to maintain clear boundaries between what you asked for and what the page said.
That is the pattern. A hole gets closed; the class stays open. NIST says as much: because current mitigations do not offer full protection against all attacker techniques, designers should assume prompt injection is possible whenever a model touches untrusted input. OWASP's entry on the risk says it is unclear if there are fool-proof methods of prevention. And Willison, who coined the term "prompt injection" in 2022, called the remaining 11.2 percent attack rate "catastrophic" — because one in nine, against a deliberate attacker, is not a rounding error. It is an invitation.
Twenty-six days from now, a different kind of answer switches on
In the United States, the framework for all of this is a promise: under the federal Secure by Design pledge, manufacturers make a good-faith effort toward the listed goals, and — in the government's own words — CISA does not enforce nor verify adherence.
The European Union took the same idea and wrote it into product law. Under Article 13(1) of the Cyber Resilience Act, Regulation (EU) 2024/2847, a manufacturer must ensure a product with digital elements has been designed, developed and produced in accordance with the essential cybersecurity requirements. Not a pledge. A duty.
Annex I is where it gets specific. Products must reach the market without known exploitable vulnerabilities, and, in Part II of the same annex, their makers must put in place and enforce a policy on coordinated vulnerability disclosure. That second line matters: what Zenity had to rely on Perplexity choosing to do is, in Europe, a legal requirement.
Browsers are not an afterthought in the annexes either. Standalone and embedded browsers are named as Class I important products — a class for which the participation of a notified body is mandatory in some cases, notably where the manufacturer hasn't applied the harmonized standards — an outside examiner rather than a self-attestation.
The clock is the story this month. The Commission confirms the reporting obligations set out in Article 14 apply from September 11, 2026 — twenty-six days after you read this — with most other provisions following on December 11, 2027. Article 14 makes a manufacturer notify an actively exploited vulnerability to its coordinating national CSIRT and the EU cybersecurity agency within 24 hours of the manufacturer becoming aware of it. The Commission spells out the rest: an early warning within 24 hours, and a full notification within 72 hours, then a final report within 14 days of a corrective measure being available. Unless particularly exceptional circumstances apply, the agency gets the information at the same time as the national team. Reports land in ENISA's Single Reporting Platform, one door instead of twenty-seven.
Two details make this more than European housekeeping. The September duties cover products including those already placed on the market, not just new ones. And it applies regardless of where the manufacturer is established — a company outside the EU that sells into it is in scope — with non-compliance drawing fines of up to EUR 15 million or 2.5% of total worldwide annual turnover, whichever is higher. San Francisco included. Article 12 even establishes a link between the two regulatory frameworks: for a high-risk AI system, meeting the CRA's product and vulnerability-handling requirements can help demonstrate compliance with the AI Act's cybersecurity article.
Now the honesty. Nothing I have found establishes that an AI browser agent is in scope of the CRA as such — the annexes name browsers, not agents, and I won't tell you a law does something no source I can check says it does. Europe hasn't solved this; it has written the underlying duty into binding text while everyone else wrote blog posts.
The machinery isn't ready either. As of June 29, 2026, that platform is not yet live. The essential requirements and the CE mark only bite at full application in December 2027, with much of the product-specific standards work unfinished. Nor is the design universally admired: in October 2023, before the text was finally adopted, the free-market R Street Institute rated the CRA "Cyber concerns exist", warning its requirements could create unintended consequences or let threat actors capitalize on reported vulnerabilities — mandatory disclosure, in that reading, handing attackers a map.
Now run it forward — say, to 2029
Imagine the agent stops being a thing you open. It is the default — your browser, your phone keyboard, the assistant in your car's console — and you stop asking it to summarize pages, because it reads everything before you do.
Now imagine the untrusted content isn't a shady site you would never visit. It is the PDF menu attached to your kid's field-trip form. A hotel confirmation. A calendar invite from your sister's book club, forwarded from someone else. Your agent reads all of it on your behalf, holding your credentials, because that is what makes it worth having. Then comes the turn the industry is already building toward: your agent negotiating with a seller's agent, a landlord's agent, an insurer's agent — every one of them, by construction rather than malice, untrusted content with a financial stake in the outcome. The trifecta stops being something you can avoid and becomes the ambient condition of doing business.
And the ugliest part is the one nobody has a good answer for. When money leaves, your bank sees a legitimate session, with your credentials, doing something you authorized an agent to be able to do. Was that fraud? Was that you? Nobody knows, and the paperwork hasn't been invented.
What the people who study this actually say
Willison goes further than any vendor will: he has written that he strongly expects the entire concept of an agentic browser extension is fatally flawed and cannot be built safely. The academic version is cooler and no more comforting — the design-patterns paper he highlighted concludes that as long as agents and their defenses rely on the current class of language models, it is unlikely that general-purpose agents can provide meaningful and reliable safety guarantees. A benchmark from Meta's researchers found attacks against web agents partially succeed in up to 86% of the case, with the caveat that matters: those are partial successes.
On the wider technique — not these browsers specifically — Palo Alto Networks' Unit 42 reports that indirect prompt injection is no longer merely theoretical but is being actively weaponized. Google measured a relative increase of 32% in the malicious category of injection attempts between November 2025 and February 2026.
What to do about it splits along familiar lines, which is why both belong here. The Electronic Frontier Foundation told a House Homeland Security subcommittee in June that governments must not adopt powerful AI without also adopting strong and clear safeguards for constitutional rights. R Street, from the other side, prescribes federal guidelines and risk-tiered liability shields rather than prescriptive product mandates. They disagree about the instrument. Neither says leave it alone.
What does this mean for you?
Not "uninstall everything" — I still use these tools. But here is the advice I should have given my friend, the one about authority:
Decide what the agent may hold, not just what it may see. Run it in a separate browser profile with its own account, clear of the pair that matters most to a thief: your primary email — which resets every other password — and anything that moves money.
Treat "summarize this page" as running a program written by whoever owns the page. Brave's demonstrations used instructions hidden in a Reddit comment, and later text hidden inside images that no human eye can see. You will not catch these by reading carefully.
Break the third leg of the trifecta on purpose. You cannot always remove the private data or the untrusted content — but you can deny the agent the ability to send, pay, publish, delete or reset without a click from you. If it can do it while you sleep, assume it will one day be asked to.
Don't read "patched" as "safe." The first Comet fix was bypassed with a modified file path. Ask whether the vendor closed a path or a class; the honest ones will tell you which.
Give it the boring, reversible work. Receipts, research, comparisons, drafts you will review. That is where these tools are genuinely excellent, and where a hijacked instruction costs you an afternoon rather than an account.
The lesson, as I see it
I keep returning to that coffee, because my error is the one the whole industry is making in miniature. I judged the agent by what it could do for me and never asked what it could be made to do to me — and those are the same capability, seen from opposite ends.
That is why "they'll patch it" is the wrong comfort. The patch closes a path; the capability stays. A system that reads untrusted text, holds your secrets and can send things outward isn't a lock with a flaw in it — it is a very helpful employee who does whatever the last person to speak to them said, and no retraining fully cures that, because the willingness to be told what to do is the job.
So no, I don't think this gets solved. I think it gets bounded — by designs that fence agents in and pay for it in capability, by disclosure duties that make failures public instead of optional, by the slow arrival of the idea that shipping a browser which can be talked into robbing you is a defect somebody owes you an answer for. Europe has started writing that answer down; the rest of us are still on a pledge nobody checks.
Until then, the useful question isn't whether you trust the company. It is the one I should have asked at that coffee: when a stranger's web page and I both give this thing an instruction, which of us does it obey?
The HAIA Foundation exists for exactly this gap — the distance between what a technology promises and what it quietly asks you to accept. Subscribe and I'll keep reading the security papers so you don't have to.