IA · 6 August 2026 · 4 min read
The Trap of AI Browsers: Black Hat Unveils the Security Risks of Web Automation
In brief: At the Black Hat 2026 security conference, cybersecurity firm Zenity demonstrated that popular AI-enabled browsers and web assistants — including OpenAI Atlas, Google, Microsoft, and Perplexity — suffer from structural security flaws. By exploiting prompt injections embedded in web pages, attackers can manipulate agents into sending mass WhatsApp spam, placing unauthorized purchases, or leaking credentials. The research reignites the debate surrounding enterprise agentic AI safety.
by Team Mocchi's
The Illusion of Security in Agentic Browsers
Integrating autonomous agents into web browsing represents one of the most promising frontiers of artificial intelligence, but also one of its most vulnerable surfaces. During the 2026 edition of the Black Hat cybersecurity conference in Las Vegas, researchers from security firm Zenity unveiled a comprehensive investigation highlighting the structural risks of web automation tools.
As reported by WIRED, the researchers identified roughly twenty vulnerabilities across major AI browsing assistants, including dedicated browsers and extensions developed by OpenAI, Google, Anthropic, Microsoft, and Perplexity. The uncovered flaws allow malicious actors to bypass security boundaries, access local files, exfiltrate browsing history, compromise password managers, and force agents to execute unauthorized actions on behalf of users.
Michael Bargury, co-founder and CTO of Zenity, emphasized that the rush to embed AI into web environments has undermined security controls refined over decades of software engineering, effectively reverting browser security back to vulnerabilities unseen for twenty years.
Prompt Injections and the Collapse of Web Boundaries
The underlying problem stems from the fundamental nature of large language models: when an AI agent reads and parses web content to summarize a page or complete a task, it cannot reliably distinguish between user commands and untrusted data embedded in the page. This vulnerability creates an ideal entry point for indirect prompt injection attacks.
In proof-of-concept demonstrations targeting OpenAI's experimental browser, Atlas, Zenity researchers successfully bypassed multiple defensive barriers. The exploit was triggered simply by instructing the agent to visit a page containing a newsletter signup form. Hidden within the page was a prompt written in Hebrew — chosen to bypass security classifiers tailored primarily for English — that tricked the agent into believing it was executing commands inside a sandbox.
Once deceived, the agent accessed the user's active WhatsApp Web session and proceeded to dispatch phishing messages to all listed contacts. In separate tests, researchers manipulated AI browsers into completing unauthorized purchases on Amazon and extracting sensitive financial details from open background tabs.
From Autonomous Browsing to Persistent System Risks
The findings presented at Black Hat reflect growing industry concerns regarding the deployment of enterprise agentic systems. Although tech companies have implemented sandboxes and permission prompts to constrain automated bots, cross-tab interactions and access to active session cookies undermine classic isolation principles like the Same-Origin Policy.
As detailed in a complementary analysis by WIRED, researchers from Fudan University and the University of Toronto demonstrated that increasing agent autonomy — such as long-term memory, multi-step planning, and code execution — dramatically increases the likelihood of models being hijacked for automated attacks. When an agent possesses active credentials and direct web access, a single hidden instruction within an HTML page can unwittingly transform it into an attack vector.
Mocchi's take
The security research presented at Black Hat serves as a reminder that deploying AI agents into business workflows cannot rely solely on the guardrails provided by platform vendors. For European companies building or adopting web automation tools and AI assistants, the engineering priority must shift from prompt engineering to system architecture. Organizations must implement a zero-trust posture by enforcing strict session boundaries, isolating credentials, and requiring explicit human-in-the-loop validation prior to executing high-risk actions or monetary transactions.