# Pwning Agentic Browsers with PleaseFix — A New Vulnerability Class for 0-Click Takeover

- URL: https://bryancowan.com/pwning-agentic-browsers-with-pleasefix-a-new-vulnerability-class-for-0-click-takeover/
- Published: August 12, 2026
- Series: Conference notes
- Tags: defcon34
- Part of: [DEF CON 34 Notes: 15 Talks on AI Security, Agentic Systems, and Red Teaming](https://bryancowan.com/def-con-34-notes-15-talks-on-ai-security-agentic-systems-and-red-teaming/)

**Speaker:** [Stav Cohen](https://info.defcon.org/defcon34/people/67935), AI Security Research Lead at Zenity and PhD student at the Technion · **Source:** [DEF CON 34 talk page](https://info.defcon.org/defcon34/content/66951)

📄 [Download this note as Markdown](https://raw.githubusercontent.com/bryancowan/defcon34-notes/main/Pwning%20Agentic%20Browsers%20with%20PleaseFix%20-%20A%20New%20Vulnerability%20Class%20for%200-Click%20Takeover.md)

## Overview

Stav Cohen's research focuses on breaking, and then fixing, AI agents — security vulnerabilities across agentic AI systems, LLM-powered applications, and enterprise AI platforms, including attacks on RAG pipelines, multi-agent delegation protocols, and agentic browsers. He introduced the concept of Promptware: a class of inference-time threats that turn GenAI models from helpful assistants into tools for data exfiltration, lateral movement, and physical-world consequences.

## Notes

### Building Websites That Compromise a Browser to Control Agentic Browsing Agents
- Goal: get it to buy something with the user's credit card, or phish using WhatsApp
- When Atlas scrolls and stops, it reruns classifiers — build the website to spread malicious instructions all over the page, with multiple attempts to get past them
- **Intent collision**: mixes the user's and the webpage's prompts to trick the agent into malicious instructions (user asks for A, agent decides it needs to do B)
- Chained a call to Amazon's Rufus assistant to buy something and change the shipping address

### Comet — File System Exfiltration
Reverse-engineered Comet's "add" button to get the agent to follow/click it, removing trigger words like "go," "action," "now" that classifiers watch for. A "meeting request" lure failed outright, but the agent still followed the link and the instructions to exfiltrate data to a remote server.

### Comet and 1Password
Starting from a calendar invite, the agent can be walked into browsing to 1Password, downloading the emergency kit, and changing the password — opening the item in a background tab so the user doesn't notice. Works with the Claude for Chrome extension too, and can also read MFA codes sent to Gmail in the browser.

### Persistence
Chrome, Edge, Comet, and Atlas all use browser history for memory and persistence (Claude does not) — poisoning history gets treated by the agent as ground truth. Used this to get Chrome to finish deleting AWS servers; an open-source GitHub repo works as another poisoning vector.

### Local Host
A calendar invite can get the browser to localhost, where local dev tools are used to interface — from there, local tools can run code (e.g. dropping user tables in a database). Worked in Comet and Edge; Chrome wouldn't click the link. Was able to use a Jupyter notebook and terminal to set up the environment.

_Filed Under:_ #defcon34