AI Browsers Vulnerable to Zero-Click "PleaseFix" Agent Hijacking

Security researchers have detailed a zero-click vulnerability affecting modern AI browsers and autonomous web agents, demonstrating how untrusted web content can hijack agent sessions without user interaction. Termed the “PleaseFix” attack, this technique allows malicious actors to take control of browser-integrated AI agents simply by tricking the agent into processing web pages containing hidden prompt injection payloads.

How “PleaseFix” Agent Hijacking Works

The attack relies on indirect prompt injection, where malicious instructions are embedded directly inside web content—such as hidden text, meta tags, or untrusted user comments—that an AI agent ingests. When an AI-enabled browser or automated web agent fetches and summarizes a page, its underlying language model parses the attacker’s hidden prompt alongside legitimate content.

Because the system treats the ingested web text as part of its operational context, the embedded instructions override the agent’s baseline system instructions. The attack executes automatically upon parsing the page, requiring zero additional user clicks or approvals to initiate the hijack.

The Privilege Boundary Problem

At its core, “PleaseFix” exploits a fundamental design challenge in current generative AI applications: the inability to maintain a strict boundary between the control plane (system instructions) and the data plane (untrusted web content). Traditional web browsers isolate script execution through origin policies and distinct execution contexts. In contrast, AI browsers feed system prompts, user queries, and raw HTML into the same LLM context window. Because language models process all tokens indiscriminately, injected text can seamlessly usurp control of the agent’s actions.

Blast Radius and Defenses

The blast radius for enterprise environments deploying AI-driven browsing tools is significant. A compromised AI agent operating within an active user session can be manipulated to exfiltrate session tokens, extract sensitive information from authenticated web applications, or perform unauthorized state-changing actions across enterprise SaaS platforms.

Because model-level prompt injection lacks a straightforward software patch, securing AI browsers requires strict architectural guardrails. Organizations deploying these tools should enforce human-in-the-loop requirements for sensitive cross-domain requests, restrict agent access to authenticated session state, and isolate untrusted web browsing contexts from internal corporate resources.