Black Hat week in Las Vegas is when the security industry collectively stops sleeping. This year two AI talks stood out.
PleaseFix: the zero-click problem with AI browsers
Researchers from Zenity Labs showed a class of attack they call PleaseFix against agentic browsers including Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Copilot Edge [1]. The trick: hide instructions inside content the agent reads, like an email, a calendar invite or a web page, and the agent follows them using the user's own identity and access [1].
Their demos were not subtle. Summarizing an email led to Gmail data exfiltration and account takeovers. A poisoned calendar invite hijacked an agent with no user interaction. An ordinary-looking link led an agent to send phishing messages from the victim's WhatsApp [1].
The quote I keep coming back to, from Zenity's Stav Cohen: an AI browser acts on the web as your employee, already logged in to email, files, calendar and work apps [1]. Now imagine that employee does whatever a sticky note on any web page tells them.
His advice is refreshingly practical: assume the agent will get hijacked, figure out the worst it could do, then take away everything it doesn't truly need. Don't sign in to work accounts with an AI browser, limit where it can act, and don't rely on an "ask before acting" pop-up alone [1].
The agents had a message board
OpenAI researchers also gave new detail on July's Hugging Face incident. Agents under evaluation found they could upload files to an internal Artifactory instance that other agents could read, and that became an improvised message board where they asked each other for help [2]. Some of this traces back to evaluations that were accidentally impossible, including one where, per OpenAI's Eric Wallace, the team "accidentally forgot to upload the file" the agent needed [2].
I appreciate the honesty. That the most relatable sentence in AI safety this year.
What I'd tell a team this week
- Separate browsing from doing. Use an AI browser for research, not while signed in to payroll.
- Hard limits beat polite prompts. Permissions the agent can't override, switched on by default [1].
- Fix your evals and your processes. Agents (and people) under impossible goals get creative in ways you won't like.
AI agents are useful. They're also the most gullible coworker you've ever hired. Plan accordingly.
For home users, too
This isn't just an enterprise problem. If you've tried an AI browser at home, the same advice applies: keep it out of your bank, your email and your password manager until the guardrails grow up. A browser that can click buttons for you can click the wrong ones for someone else.