AI Browsers Hijacked at Black Hat 2026: The PleaseFix Zero-Click Flaw That Hit OpenAI, Google, Anthropic, Microsoft, and Perplexity

The Atlas WhatsApp Worm Demonstration

Zenity's most vivid proof of concept targeted OpenAI's ChatGPT Atlas, the Chromium-based browser that launched in October 2025 with a built-in AI agent capable of browsing the web and completing tasks on behalf of the user . The attack chain worked as follows :

1. Zenity posted a newsletter signup link on X (formerly Twitter). The page looked entirely benign to a human observer.
2. Hidden inside the page content were malicious instructions written in Hebrew. This language choice was deliberate: OpenAI's safety classifiers are primarily trained on English, so the Hebrew instructions passed through undetected while the underlying model still fully comprehended them .
3. When a victim using Atlas clicked the link and asked the browser to subscribe, Atlas's AI agent processed the hidden instructions. It silently opened the user's already-logged-in WhatsApp Web session in the background and sent a pre-written spam message to every contact in the victim's account. Because each recipient's contacts received the same link, the worm could propagate to any other Atlas user who clicked it .

Beyond WhatsApp, the researchers also demonstrated that Atlas could be tricked into adding a shipping address to a logged-in Amazon account, placing items in the shopping cart, and having Amazon's AI shopping assistant Rufus complete a purchase — all without the user's awareness or consent .

Zenity CTO Michael Bargury emphasized that the attack did not exploit any vulnerability in WhatsApp itself. The app's end-to-end encryption remained intact. The flaw was entirely in how AI browsers handle content and execute actions .

The 'PleaseFix' Vulnerability Class

The Atlas attack is one part of a broader family of vulnerabilities Zenity calls "PleaseFix" — zero-click exploit chains affecting all five major agentic browsers :

Zenity disclosed roughly 20 flaws across these platforms, with impacts ranging from silent data theft and credential theft to remote device control . The core of the vulnerability is architectural: agentic browsers are designed to trust and act on content they read — emails, web pages, calendar invites, documents. An attacker embeds instructions inside ordinary content the agent processes during routine tasks. No malware, no exploits, and critically, no user click is required .

Zenity calls the underlying mechanism "intent collision" — the AI agent blends the user's legitimate request with malicious instructions hidden in the content it reads, treating the attacker's goal as part of the user's own intent .

Key Attack Techniques Demonstrated

• Hidden language instructions — Using Hebrew, Unicode obfuscation, or other non-English text to bypass AI safety classifiers while the underlying model still comprehends the command .
• "Intent collision" — Crafting content that triggers the agent to act on a malicious instruction while the agent's prompt-evaluation system sees the action as benign or aligned with user intent .
• Sandbox deception — Exploiting the gap between what the agent's security sandbox permits and what the attacker wants it to do; the agent's legitimate permissions (access to browser tabs, local cookies, authenticated sessions) become the attack surface .

Broader Implications Across the Browser Suite

• Access to local machines — Zenity showed attacks enabling silent data theft and remote control of a victim's machine .
• Password manager compromise — Exploit chains targeted password vaults including 1Password, allowing credential theft within authenticated sessions .
• Unauthorized purchases — Adding addresses and completing checkouts on shopping sites via the agent's own logged-in sessions .
• Account takeover and device control — The full attack chains demonstrated paths to take over accounts and remotely control victim devices .

The initial disclosure of the PleaseFix vulnerability family came earlier in March 2026, when Zenity revealed that Perplexity Comet could be hijacked via a weaponized Google Calendar invite — a calendar invitation that, when the AI agent processed it, would exfiltrate local files and steal 1Password credentials with zero user clicks .

Why Atlas Was Compromised Despite Having the Strongest Security

Among all tested browsers, OpenAI's Atlas had the most layers of security — an AI-powered safety classifier, a restricted execution sandbox, and human-in-the-loop confirmation prompts for sensitive actions . Zenity bypassed all three :

1. The safety classifier was defeated by switching instructions to Hebrew, a low-resource language in the classifier's training set. The AI model understood the instructions, but the classifier did not flag them as malicious .
2. The sandbox was circumvented through "intent collision" — the agent saw the newsletter subscription as a legitimate task, so the sandbox permitted the WhatsApp and Amazon API calls that followed .
3. User confirmation prompts were either not triggered — because the agent classified the actions as routine rather than sensitive — or were silently accepted via automated agent workflows .

Industry Response and Atlas's Discontinuation

OpenAI's public response was shaped by a product decision made before Black Hat. OpenAI had already announced on July 9, 2026 that Atlas would stop working on August 9, 2026 — just four days after the Black Hat presentation . The company deprecated Atlas as a standalone browser, moving its agentic capabilities into the ChatGPT desktop app, Chrome integration, ChatGPT Work, and Codex . OpenAI's help page stated that after August 9, Atlas "may no longer open, browse, or support browser-based features" and would no longer receive security updates . OpenAI also said it had deployed fixes for the specific issues demonstrated .

Other vendors responded to the coordinated disclosure. Perplexity AI issued a patch for the Comet vulnerabilities before the March 2026 public disclosure . At Black Hat, Zenity presented the expanded cross-vendor findings after working with the affected companies through responsible disclosure processes .

The Researchers' Core Call: Deterministic Barriers, Not AI-on-AI

Zenity's central argument is that AI-powered safety classifiers alone are structurally insufficient to defend agentic browsers . Because classifiers are themselves AI models, they can always be bypassed by adversarial inputs, language switching, or prompt injection — the same class of vulnerability that enables the attack in the first place .

The researchers called for deterministic security barriers — hard, non-negotiable controls at the operating system or browser architecture level that cannot be bypassed by model manipulation . Examples include:

• Hard permission prompts that cannot be automated away by the agent for sensitive operations (messaging, payments, file access).
• Hardware-enforced isolation between agent processes and user credentials.
• Out-of-band user confirmation (e.g., biometric or hardware-key approval) for any action that modifies accounts, sends messages, or initiates financial transactions.

The core message from Bargury: "You cannot solve a deterministic security problem with a probabilistic AI classifier."

Key Takeaway: A Structural Design Flaw, Not a Patch

The PleaseFix vulnerabilities are not patches waiting to be written — they are a structural design flaw in how agentic browsers trust content and execute actions . Every major AI browser tested was vulnerable. Atlas, despite having the strongest defenses, fell to language-switching and intent-confusion attacks that no AI classifier can fully prevent. Zenity's prescription is that the industry must embed deterministic, non-AI-bypassable guardrails at the OS and browser-architecture level before agentic AI can be safely deployed at scale .