One Email, Five AI Browsers, Zero Clicks: What PleaseFix Gets Right About Agent Identity

What happened

At Black Hat USA 2026 this week, Zenity Labs disclosed the full scope of a vulnerability class it calls PleaseFix— a family of zero-click exploits affecting every major agentic browser on the market: Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge. Using a universal technique the researchers named Intent Collision, they chained these bugs into full attacks achieving account takeover, data theft, persistent implants, and remote code execution — all without the victim clicking, approving, or knowingly executing anything (Zenity Labs, PleaseFix: Zero-Click AI Agent Vulnerabilities).

The demonstrated exploit chains are not subtle. With Claude in Chrome, a single prepared email combined with a routine inbox-summary request let attackers exfiltrate the victim's Gmail, share their entire Google Drive, and seize control of their Slack, X, and Claude accounts (Notebookcheck, “Claude, Gemini, Comet: five AI browsers hijacked by a single email,” Aug 7, 2026). Zenity's own research page catalogs the rest: Comet reaching full reverse-shell access through a local Ollama instance, Gemini reaching a victim's system through Jupyter notebooks, Atlas silently adding an attacker to private GitHub repositories, and a persistence technique the researchers call HistoryFixing that plants fabricated entries in browser history to cover tracks (Zenity Labs research page).

This is a widening, not a debut. Zenity first disclosed a related bug — PerplexedAgent, targeting Perplexity Comet and its integration with the 1Password extension — back in March 2026, and both Perplexity and 1Password fixed the specific issue before it went public (Zenity Labs newsroom, March 2026 disclosure). What's new this week is the scope: the same underlying flaw, present across five different vendors' products at once, demonstrated with full end-to-end exploit chains rather than a single proof of concept.

Why patching the bug won't fix the problem

Michael Bargury, Zenity's co-founder and CTO, has been consistent about what this actually is. Describing the earlier PerplexedAgent disclosure, he said plainly: “This is not a bug. It is an inherent vulnerability in agentic systems. Attackers can push untrusted data into AI browsers and hijack the agent itself, inheriting whatever access it has been granted” ( Zenity Labs newsroom). On this week's full disclosure, he sharpened the point: “Browsers have always kept every website separate from every other one, so that a random page cannot reach your logged-in bank account. That principle is called the same-origin policy. Agentic browsers dismantle it, because their assistant reasons across content from different sources in a single session” ( Notebookcheck).

That is the whole story in two sentences. An agentic browser's assistant does not have its own identity distinct from the human who is logged in. It acts asthe user, with all of the user's cookies, sessions, and permissions, and it cannot reliably tell the difference between an instruction the user typed and an instruction hidden in an email, a calendar invite, or a webpage the assistant happened to read while doing something else. Intent Collision is the name for exactly that confusion: hidden content redirects the agent to act on an attacker's behalf while wearing the user's own credentials.

Authorization was never the right layer

What makes this disclosure worth reading past the headline is that Zenity has already published the diagnosis for its own finding. In an earlier piece on identity and access management for agents, the firm's research argued that IAM controls can tell you what an agent was permittedto do, but nothing about whether what it actually did was appropriate: “Authorization tells you what was reachable. Behavioral monitoring tells you what actually happened” (Zenity Labs, “The Authorization Trap: What IAM Misses About AI Agent Behavior”).

PleaseFix is that trap, instantiated. Every agent Zenity hijacked was, on paper, authorized to read the user's inbox, access their Drive, and act inside their logged-in sessions — that authorization is the entire point of an agentic browser. The permission was never the failure. The failure was that nothing was watching whether the agent's actual, observed behavior in the moment matched what the user meant, versus what a hidden instruction wanted. A static grant of access cannot answer that question. Only continuous observation of behavior can.

The Skoor alignment — and where it stops

This event sits squarely in the two problems SKOOR was built around, and it's worth being precise about which ones and which don't apply. PleaseFix is a browser-assistant problem — a general-purpose AI acting inside a human's session with the human's own identity. It is not, today, a report about the autonomous commercial agents that transact under their own registered identity in the way SKOOR scores. The honest connection is architectural, not a direct incident match.

The first piece is identity that belongs to the agent, not the human it acts for. Every PleaseFix exploit works precisely because the browser's assistant has no identity of its own— it borrows the user's, so an attacker who hijacks the agent inherits the human's whole account footprint in one move. The AAIN — the Autonomous Agent Identification Number — is SKOOR's answer to that exact design flaw for commercial agents: a permanent identifier that belongs to the agent itself, is separate from whoever deployed it, and lets every action the agent takes be attributed to it specifically rather than laundered through a human's session. An agent with its own identity can be rate-limited, scored, and cut off without touching the human's underlying accounts at all.

The second piece is exactly the gap Zenity itself named: authorization tells you what was reachable, not what actually happened. SKOOR is a continuous, 300–850 behavioral score recomputed from ten factors, not a one-time permission grant. Two of those factors map directly onto Intent Collision:

SKOOR scores over 152,000 registered agents today, recomputed continuously as new behavior lands — the live count as of this morning is 152,803 (api.skoor.ai/v1/ac3s/analytics/distribution). None of that retroactively fixes a same-origin-policy gap inside a browser's rendering engine — that is squarely an engineering fix the browser vendors owe their users. What identity and continuous scoring add is a second, independent layer: even if an agent is momentarily hijacked, its actions are attributable to a specific registered identity and its deviation from normal behavior is visible immediately, instead of surfacing only when a security firm demos it on stage months later.

What this means if AI acts on your business's behalf

If your business uses an agentic browser or AI assistant that has access to your email, cloud storage, or connected accounts, PleaseFix is not an abstract research finding — it is a description of what a single malicious email in your inbox can currently do without you clicking anything. A few takeaways that don't require becoming a security expert:

• Scope access tightly. An assistant that can read email, share files, and manage logins in one session has a blast radius as wide as your entire digital footprint. Grant the narrowest access that gets the job done.
• Separate identities for anything that transacts. A general-purpose browser assistant borrowing your login is a different risk category from a purpose-built commercial agent with its own registered, attributable identity and a visible track record.
• Ask whether behavior is monitored, not just whether access is authorized.Zenity's own framing is the right question to ask any vendor: can you tell me what my agent actually did, in real time, not just what it was theoretically allowed to do?

The agentic browser vendors will patch the specific exploit chains Zenity demonstrated. The underlying design choice — an assistant that inherits a human's identity wholesale instead of carrying its own — is a harder problem, and it is the same problem the agent commerce world is trying to solve from the other direction: give every acting agent its own name, and make its behavior, not just its permissions, something anyone can check.