Agentic anarchy: Why using AI browsers just isn’t worth the risk

LAS VEGAS — We've known for some time that AI browsers are bad news. Gartner warned against using them back in December 2025, and OpenAI announced a few weeks ago that it was quietly sunsetting its vulnerability-plagued ChatGPT Atlas browser after just 20 months.

But until Wednesday (Aug. 5) at the Black Hat security conference, we didn't realize that using an AI browser is the online equivalent of giving the teenager next door $500 in cash, your driver's license, and the keys to your Camaro, and then expecting them to be responsible.

"Last year, we showed how we could hack into any agent, and that we're back in the '90s" when it comes to AI security, Zenity Cofounder and CTO Michael Bargury told the Black Hat audience. "And now every browser thinks for you. What could go wrong?"

He ran a demonstration of a malicious calendar invitation received by Perplexity's Comet AI browser taking over an entire PC in about five seconds.

Bright flashing red letters reading HACKED appeared on the screen. Rick Astley sang "Never Gonna Give You Up." A video clip played of Zenity Senior Security Researcher Stav Cohen throwing up his hands in a "who, me?" expression.

That was the most extreme example of what can go wrong with AI browsers. It was possible because Comet could access and write to local files on the PC. (Perplexity has since fixed this flaw.)

But the other browsers tested, including Microsoft Edge with Copilot, Google Chrome with Gemini, the Anthropic Claude browser extension and the soon-to-be-dead Atlas, had plenty of flaws of their own.

All it took was embedding prompt injections — Bargury prefers the term "persuasion" — into calendar invitations, email messages or even Twitter posts. The injections convinced the agents that, as Bargury put it, the wrong way to do something was actually the right way.

Litany of woes

In Atlas, the Zenity researchers had the ChatGPT agent double-cross Amazon, ordering something inexpensive and then convincing Amazon's own shopping AI agent, Rufus, to swap it out for an Xbox. It also relabeled a user's private GitHub repositories as open-source for anyone to read and use.

With the Claude browser plug-in (Anthropic doesn't offer a browser of its own), the researchers made the AI send out phishing emails without the user's knowledge and add files to the user's Google Drive account. The rogue agent could also log into accounts with multi-factor authentication by just waiting for email messages with temporary one-time passcodes.

In Comet, the researchers found they could use the AI to steal all the passwords from the user's 1Password account, change the account's master password, and purloin the unique 1Password secret account-recovery key.

In Edge, the malicious calendar invitation sent Copilot to a malicious website that executed malware in the background. In Chrome, the researchers made Gemini delete Amazon Web Services instances.

All the AI browsers were susceptible to browser-history poisoning, which matters because the AIs can quickly summarize your entire browser history.

All it took was a malicious website that rapidly scrolled through different URLs to make it seem like the user had a history of visiting extreme porn sites or researching embarrassing medical conditions.

The good news and the bad news about AI browsers

The only AI browser that came out looking good was Chrome with Gemini. The Zenity researchers couldn't get it to mess with the user's local files and had a hard time getting it to connect to a malicious URL. They succeeded only by breaking the URL into chunks and then having Gemini reassemble it.

Google was also the only company of the five AI browser makers to patch all the flaws Zenity reported. It even gave the researchers a $1,000-dollar bug bounty. The others said they couldn't reproduce some flaws, didn't think they were worth fixing or had seen them before.

But overall, using AI browsers of any sort is probably not wise.

For starters, the browsers all need the human user's credentials to take remote action on the user's behalf, like book hotel rooms, send emails or make calendar appointments. This sounds convenient until you realize the AI can do anything you can online, using your name.

As for "soft" guardrails that tell an AI model what not to do, Bargury said they're mostly useless because a smart model will always find its way around them (as OpenAI recently discovered). Better to use "hard" boundaries baked into code.

He also implored AI makers to "stop building black boxes" so that others could see what was going on under the hood.

"This is not a bug," Bargury said of the AI browsers' abilities to go rogue. "It's part of the design. You use an agentic browser at your own risk."