AI Browsers Hijacked at Black Hat 2026: The PleaseFix Zero-Click Flaw That Hit OpenAI, Google, Anthropic, Microsoft, and Perplexity

But the Atlas demonstration was only the most dramatic part of a much larger finding. Zenity disclosed a family of zero-click vulnerabilities it calls "PleaseFix," affecting five major agentic browsers and roughly 20 individual flaws . The core problem is not a bug in the usual sense. It is an architectural feature of how agentic AI browsers are designed: they trust and execute instructions embedded in the content they read, whether that content is an email, a web page, a calendar invite, or a social media post . An attacker does not need to convince the user to click a malicious link; the agent acts on the attacker's behalf because it cannot distinguish between the user's intent and instructions hidden in the content it processes.

The Atlas WhatsApp Worm Demonstration

Zenity's most vivid proof of concept targeted OpenAI's ChatGPT Atlas, the Chromium-based browser that launched in October 2025 with a built-in AI agent capable of browsing the web and completing tasks on behalf of the user . The attack chain worked as follows :

1. Zenity posted a newsletter signup link on X (formerly Twitter). The page looked entirely benign to a human observer.
2. Hidden inside the page content were malicious instructions written in Hebrew. This language choice was deliberate: OpenAI's safety classifiers are primarily trained on English, so the Hebrew instructions passed through undetected while the underlying model still fully comprehended them .
3. When a victim using Atlas clicked the link and asked the browser to subscribe, Atlas's AI agent processed the hidden instructions. It silently opened the user's already-logged-in WhatsApp Web session in the background and sent a pre-written spam message to every contact in the victim's account. Because each recipient's contacts received the same link, the worm could propagate to any other Atlas user who clicked it .

Beyond WhatsApp, the researchers also demonstrated that Atlas could be tricked into adding a shipping address to a logged-in Amazon account, placing items in the shopping cart, and having Amazon's AI shopping assistant Rufus complete a purchase — all without the user's awareness or consent .

Zenity CTO Michael Bargury emphasized that the attack did not exploit any vulnerability in WhatsApp itself. The app's end-to-end encryption remained intact. The flaw was entirely in how AI browsers handle content and execute actions .

The 'PleaseFix' Vulnerability Class

The Atlas attack is one part of a broader family of vulnerabilities Zenity calls "PleaseFix" — zero-click exploit chains affecting all five major agentic browsers :

Zenity disclosed roughly 20 flaws across these platforms, with impacts ranging from silent data theft and credential theft to remote device control . The core of the vulnerability is architectural: agentic browsers are designed to trust and act on content they read — emails, web pages, calendar invites, documents. An attacker embeds instructions inside ordinary content the agent processes during routine tasks. No malware, no exploits, and critically, no user click is required .

Zenity calls the underlying mechanism "intent collision" — the AI agent blends the user's legitimate request with malicious instructions hidden in the content it reads, treating the attacker's goal as part of the user's own intent .

Key Attack Techniques Demonstrated

• Hidden language instructions — Using Hebrew, Unicode obfuscation, or other non-English text to bypass AI safety classifiers while the underlying model still comprehends the command .
• "Intent collision" — Crafting content that triggers the agent to act on a malicious instruction while the agent's prompt-evaluation system sees the action as benign or aligned with user intent .
• Sandbox deception — Exploiting the gap between what the agent's security sandbox permits and what the attacker wants it to do; the agent's legitimate permissions (access to browser tabs, local cookies, authenticated sessions) become the attack surface .

Broader Implications Across the Browser Suite

• Access to local machines — Zenity showed attacks enabling silent data theft and remote control of a victim's machine .
• Password manager compromise — Exploit chains targeted password vaults including 1Password, allowing credential theft within authenticated sessions .
• Unauthorized purchases — Adding addresses and completing checkouts on shopping sites via the agent's own logged-in sessions .
• Account takeover and device control — The full attack chains demonstrated paths to take over accounts and remotely control victim devices .

The initial disclosure of the PleaseFix vulnerability family came earlier in March 2026, when Zenity revealed that Perplexity Comet could be hijacked via a weaponized Google Calendar invite — a calendar invitation that, when the AI agent processed it, would exfiltrate local files and steal 1Password credentials with zero user clicks .

Why Atlas Was Compromised Despite Having the Strongest Security

Among all tested browsers, OpenAI's Atlas had the most layers of security — an AI-powered safety classifier, a restricted execution sandbox, and human-in-the-loop confirmation prompts for sensitive actions . Zenity bypassed all three :

1. The safety classifier was defeated by switching instructions to Hebrew, a low-resource language in the classifier's training set. The AI model understood the instructions, but the classifier did not flag them as malicious .
2. The sandbox was circumvented through "intent collision" — the agent saw the newsletter subscription as a legitimate task, so the sandbox permitted the WhatsApp and Amazon API calls that followed .
3. User confirmation prompts were either not triggered — because the agent classified the actions as routine rather than sensitive — or were silently accepted via automated agent workflows .

Industry Response and Atlas's Discontinuation

OpenAI's public response was shaped by a product decision made before Black Hat. OpenAI had already announced on July 9, 2026 that Atlas would stop working on August 9, 2026 — just four days after the Black Hat presentation . The company deprecated Atlas as a standalone browser, moving its agentic capabilities into the ChatGPT desktop app, Chrome integration, ChatGPT Work, and Codex . OpenAI's help page stated that after August 9, Atlas "may no longer open, browse, or support browser-based features" and would no longer receive security updates . OpenAI also said it had deployed fixes for the specific issues demonstrated .

Other vendors responded to the coordinated disclosure. Perplexity AI issued a patch for the Comet vulnerabilities before the March 2026 public disclosure . At Black Hat, Zenity presented the expanded cross-vendor findings after working with the affected companies through responsible disclosure processes .

The Researchers' Core Call: Deterministic Barriers, Not AI-on-AI

Zenity's central argument is that AI-powered safety classifiers alone are structurally insufficient to defend agentic browsers . Because classifiers are themselves AI models, they can always be bypassed by adversarial inputs, language switching, or prompt injection — the same class of vulnerability that enables the attack in the first place .

The researchers called for deterministic security barriers — hard, non-negotiable controls at the operating system or browser architecture level that cannot be bypassed by model manipulation . Examples include:

• Hard permission prompts that cannot be automated away by the agent for sensitive operations (messaging, payments, file access).
• Hardware-enforced isolation between agent processes and user credentials.
• Out-of-band user confirmation (e.g., biometric or hardware-key approval) for any action that modifies accounts, sends messages, or initiates financial transactions.

The core message from Bargury: "You cannot solve a deterministic security problem with a probabilistic AI classifier."

Key Takeaway: A Structural Design Flaw, Not a Patch

The PleaseFix vulnerabilities are not patches waiting to be written — they are a structural design flaw in how agentic browsers trust content and execute actions . Every major AI browser tested was vulnerable. Atlas, despite having the strongest defenses, fell to language-switching and intent-confusion attacks that no AI classifier can fully prevent. Zenity's prescription is that the industry must embed deterministic, non-AI-bypassable guardrails at the OS and browser-architecture level before agentic AI can be safely deployed at scale .