Israeli cybersecurity company Zenity Labs uncovered a new class of vulnerabilities affecting AI-powered browsers, demonstrating how attackers can manipulate AI agents into stealing information, taking over accounts and gaining control of users’ devices without requiring a single click. The research, presented on Wednesday at the Black Hat USA security conference, identified “PleaseFix” vulnerabilities in Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Microsoft’s Copilot Edge. The attacks exploit how AI agents read information from multiple sources and act on behalf of users, creating a new security risk. Attackers can hide malicious instructions inside content an AI agent encounters, and the agent follows them using the user’s identity, permissions and connected accounts. Zenity, which announced a $125 million Series C earlier this week, demonstrated attacks ranging from data theft to full machine compromise. In one example, a malicious email tricked Claude in Chrome into extracting Gmail data, sharing a user’s Google Drive with an attacker and compromising Slack and Claude accounts. A poisoned calendar invitation on Perplexity Comet allowed access to local files, steal credentials and compromise a password manager account. On ChatGPT Atlas, a malicious social media link manipulated the agent into sending phishing messages via WhatsApp and preparing an Amazon purchase for an attacker-controlled address. On Comet, Gemini and Edge, attackers could reach local developer tools and internal services, potentially gaining control over the victim’s machine. Zenity disclosed the findings to Anthropic, Perplexity, Google