At Black Hat USA 2026, researchers from Israeli cybersecurity firm Zenity Labs unveiled a set of vulnerabilities dubbed “PleaseFix” that enable zero-click attacks against browser-integrated AI agents. Affected platforms include Anthropic’s Claude in Chrome, Google’s Gemini in Chrome, Perplexity’s Comet, OpenAI’s Atlas, and Microsoft’s Copilot in Edge – essentially the entire mainstream lineup of AI browser agents companies have rolled out over the past year.
What “zero-click” means for an AI agent
Classic phishing needs a victim to click a link or open an attachment. A zero-click attack removes that requirement entirely – an AI agent only needs to encounter malicious content during its normal work (say, while reading a web page or summarizing an email) for the attack code to execute, with no user action at all. For an agent with access to logged-in accounts, a mailbox, or internal systems, the blast radius is fundamentally worse than a typical web XSS bug.
Why this matters for your business
Companies are increasingly deploying AI agents that read email, browse internal documents, or complete browser tasks on an employee’s behalf. If such an agent hits a compromised page or a carefully crafted message, it can – without anyone noticing – leak sensitive data, take an unauthorized action, or become an entry point deeper into your infrastructure. In parallel, researchers published findings in early August covering attack chains through Outlook, Gmail, Fastmail, Proton Mail, and other mail services that target exactly this class of AI tools.
How to protect yourself today
Track what permissions your AI agents actually need and scope them down to the minimum – access to payment details or sensitive systems should require explicit approval, not automatic click-through. Keep browsers and AI extensions updated, since vendors are shipping patches for PleaseFix and similar findings on an ongoing basis. And if an agent works with unverified content – a random website, an incoming email – assume that content may contain hidden instructions; that’s exactly the attack class PleaseFix demonstrates.
Conclusion
Browser-based AI agents deliver real time savings, but this is still young technology with security gaps the traditional web has long since addressed. Want to discuss how to deploy AI tools safely at your company, or have your systems’ exposure checked? Get in touch.
