Researchers Hijacked Five AI Browsers Without a Single Click: Run the Two-Lane Fix This Week

What happened. Security researchers at Zenity Labs disclosed a vulnerability class called PleaseFix, and this month laid out its full scope after demonstrating live exploit chains at Black Hat USA 2026. The demos ran against five AI browsers with agent features turned on: Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge.

The attack takes zero clicks. The attacker plants instructions inside something the agent reads while doing an ordinary job for you: a web page, an email, a calendar invite. Zenity calls the technique Intent Collision. Your request and the attacker's hidden request land in the same context, and the agent follows the wrong one.

Why this one matters more than the usual scare headline. An AI browser agent works while you are logged in. Same session, same cookies, same permissions, across every tab you have open. A hijacked agent is therefore operating as you, with your access to your inbox, your CRM, your bank portal, your payroll tool. Demonstrated outcomes in the research ran from data and credential theft up to account takeover.

The researchers describe this as architectural, meaning it comes from how agents read untrusted content in the first place. That makes "wait for the patch" a weak plan.

The move: run two browser lanes. Fifteen minutes, today.

1. Turn agent mode off by default. Open your AI browser's settings and switch autonomous or agentic browsing off. Make it a thing you turn on for one specific task, then turn back off.
2. Create a second browser profile and call it "AI lane." This is where the agent works: research, reading articles, comparing vendors, summarizing a public page. Sign into nothing in it.
3. Keep the money lane clean. Your normal profile holds email, banking, payroll, CRM, cloud storage, and admin panels, with agent features off. Sign those accounts out of the AI lane and leave them out.
4. Give your team one sentence. "The AI browser never touches anything that moves money or holds customer data." That is the whole policy.
5. Treat surprise actions as the alarm. If an agent starts doing something you did not ask for, close the tab rather than replying to it. Then check the account it was touching.

What it's worth. Fifteen minutes against the cost of one compromised inbox: the wire that goes out, the customer list that walks, the week you spend resetting every credential in the company. The agent features still work. They just work in a lane where a bad page cannot reach your bank.