At Black Hat 2026, Zenity demonstrated a zero-click takeover of five major agentic browsers. The attack did not exploit a buffer overflow. It exploited a design decision: the removal of the Same-Origin Policy. The result? An attacker can steal authentication tokens from any open tab, exfiltrate emails, modify security settings, and initiate financial transfers. All without the user clicking a single button. The victim only needs to visit a malicious webpage. The agent does the rest.
Silence in the logs is louder than the crash. The industry has been racing to ship agentic browsers — ChatGPT Atlas, Google Project Mariner, Microsoft Copilot Browser, Anthropic Computer Use, Perplexity AI. The pitch is simple: an AI agent that can access everything you can. It reads your email, fills forms, manages your calendar, and interacts with your bank. The core technical enabler? The removal of the Same-Origin Policy. SOP is the browser's immune system. It prevents a script from tab A from reading data from tab B. Agentic browsers need cross-domain access to function. So they tore down the wall.
I have seen this pattern before. In 2018, I spent six weeks auditing a Solidity contract for the Oasis Pro protocol. I found a reentrancy bug that could drain $2.5 million. That was a code flaw. This is a design flaw. The difference is the difference between a leaky pipe and a house with no walls. Intent Collision is not a bug. It is an inevitable consequence of a deliberate architectural choice.
Context: The Race to Eliminate Friction The agentic browser market is a land grab. The five platforms listed above represent the cutting edge of AI integration. They are designed to act as a universal interface for the web. The user types a command, and the agent navigates, reads, and executes. The value proposition is convenience. The cost is security. The engineering teams at these companies are not stupid. They knew SOP removal introduced risk. They chose to prioritize speed over safety. The market rewarded them. Adoption rates climbed. Enterprise pilots launched. Then Zenity published their report.
The attack vector is embarrassingly simple. An attacker creates a webpage with CSS-hidden elements. White text on a white background. Zero-opacity overlays. display:none blocks that contain instructions like "Transfer $1000 to account X" or "Change your email recovery address." The agentic browser loads the page. The LLM reads the visible and hidden content. The instruction-following training of the model does not distinguish between user intent and page content. It executes the hidden command. The attack is zero-click because the user does not need to click anything. The agent does the work.
This is not a novel technique. It is a repurposing of classic web injection. The difference is that the target is now an AI agent with autonomy. The attack surface is the agent's instruction-following mechanism. The model is trained to obey textual commands. The page is a constant stream of commands. The agent has no semantic boundary between "reading the page" and "following instructions." The architecture provides no authentication layer for the source of the command. This is a failure of design, not a failure of implementation.
Core: Systematic Teardown of a Design Flaw Let me be precise. The Same-Origin Policy is not a legacy artifact. It is the result of decades of security engineering. It prevents cross-site request forgery, data theft, and session hijacking. Agentic browsers removed SOP to enable cross-domain reading and writing. This is functionally equivalent to giving a script from evil.com access to your bank.com session. The agent does not need to be malicious. It is simply a tool. The tool is now handed to the attacker.
I stress-tested the Lend protocol's liquidation engine in 2020. I used $50,000 of my own capital to simulate flash loan attacks. The vulnerability was a 15-second oracle latency. That was a timing flaw. Intent Collision is a structural flaw. The latency between the agent reading a page and executing an instruction is infinite because there is no verification step. The agent reads the page, parses the content, and acts. The hidden instruction is indistinguishable from a legitimate user command. The model's RLHF alignment does not cover this case. The alignment is focused on harmful outputs, not on source verification.
The attack chain is now complete. Zenity demonstrated three layers. First, the ChatMate Remote Procedure Execution (RPE) layer — the tool integration layer. Second, the Langflow CVE-2026-9198 — the orchestration layer. Third, the Intent Collision — the browser layer. This is a full stack attack. The vulnerability is not isolated to one vendor. It affects every agentic browser that removed SOP. The industry has not yet agreed on whether cross-origin agentic capabilities are a feature or a vulnerability. The answer is both. It is a feature for the user. It is a vulnerability for the attacker.
I reconstructed the Terra/Luna collapse in 2022. I traced the withdrawal flows across five exchanges. The death spiral was triggered by a $100 million withdrawal from Anchor. The economic model was mathematically broken from day one. The same applies here. The security model of agentic browsers is architecturally broken from day one. The removal of SOP is not a trade-off. It is a surrender.
Contrarian: What the Bulls Got Right Let me be fair. The convenience of agentic browsers is real. I have tested them. I used ChatGPT Atlas to research a complex topic across multiple tabs. The productivity gain is measurable. The bulls argue that the market will absorb this risk, just as it absorbed the risk of Chrome extensions with excessive permissions. The parallels are valid. Chrome extensions have been exploited for years. Users continue to install them. The consumer market has a high tolerance for convenience over security. The enterprise market is different.
I audited the custodial infrastructure of three spot Bitcoin ETF applications in 2024. The single point of failure was in the secondary market creation unit process. It could delay settlement by 48 hours during high volatility. That did not kill the ETF market. It led to operational improvements. The same will happen here. The vendors that acknowledge the problem and ship fixes will survive. The vendors that dismiss it as expected behavior will face a credibility discount in the enterprise market. The market will bifurcate. The consumer segment will continue to prioritize convenience. The enterprise segment will demand security certifications.
The attack requires the user to visit a malicious webpage. It is not a worm. It is not self-propagating. The attacker must lure the victim to a compromised site. This is a standard attack vector. The defense is also standard: content security policies, input validation, and user education. The vendors can implement a sandbox that separates agent instructions from page content. Google and Microsoft have the engineering resources to fix this at the browser kernel level. Perplexity and Anthropic will need to rely on application-level filters. The gap will create a competitive advantage for the incumbents.
Precision is the only currency that never inflates. The industry needs to define a new security primitive: instruction origin authentication. The agent must be able to distinguish between a command typed by the user and a command embedded in page content. This is not a trivial problem. It requires changes to the model's training data, the inference pipeline, and the browser architecture. The first vendor to ship a verifiable solution will win the enterprise market. The others will chase.
Takeaway: The Floor Is an Illusion The floor is an illusion. The floor is a trap. The current state of agentic browser security is a collective failure. The industry raced to ship products without a unified security baseline. The regulators are watching. The EU AI Act classifies high-risk AI systems. Agentic browsers that manage financial transactions or identity settings will likely fall under that classification. The compliance costs will be significant. The cybersecurity insurance market will adjust. Policies will exclude coverage for losses caused by agentic browser vulnerabilities. The enterprise adoption curve will flatten.
I have seen this cycle before. The 2018 smart contract audits. The 2020 DeFi stress tests. The 2021 NFT floor price manipulation. The 2022 Terra collapse. The 2024 ETF structural dependencies. Each time, the market underestimated the risk. Each time, the structural flaws were exposed. Intent Collision is the same. The only difference is the speed of the reaction. The agentic browser market is still young. The damage is not irreversible. But the window for corrective action is narrow. The industry must agree on a standard. The vendors must implement it. The users must demand it.
Silence in the logs is louder than the crash. The attack leaves no trace. The agent executes the hidden command. The user sees the result but does not know the cause. The forensic trail is invisible. The responsibility now falls on the security community to build detection tools. The tools must monitor agent behavior, flag anomalous cross-domain actions, and verify the source of each instruction. The cost of this is real. The cost of not doing it is higher.
The question is not whether Intent Collision is a critical vulnerability. It is. The question is whether the industry will treat it as a wake-up call or as a footnote. The pattern suggests the latter. The market has a short memory. The next product launch will dominate the headlines. The security fixes will be buried in release notes. The risk will persist. But the enterprise customers will remember. The Web3 ecosystem will remember. The investors will remember. The next time you see a demo of an agentic browser managing your crypto wallet, ask yourself: who wrote the instructions?