AI Browser Zero-Click Attacks: Israeli Researchers Uncover Flaws

Israeli researchers have uncovered zero-click attacks targeting AI-powered browsers. Zenity Labs demonstrated vulnerabilities in platforms like Claude, Gemini, Perplexity, ChatGPT Atlas, and Microsoft’s Copilot Edge. These attacks can hijack AI agents and access user data without requiring a single click. Zenity calls these "PleaseFix" vulnerabilities. They exploit how AI browsers read information from various sources and act on behalf of users. Attackers can hide malicious instructions within content the AI agent encounters. The agent then follows these instructions using the user’s identity and permissions. Zenity showed attacks ranging from data theft to full machine compromise. For example, a malicious email could trick Claude into extracting Gmail data and sharing a user's Google Drive. A poisoned calendar invitation could allow access to local files and steal credentials from Perplexity Comet. Attackers could also manipulate ChatGPT Atlas to send phishing messages via WhatsApp or prepare an Amazon purchase. Zenity also showed how these vulnerabilities could extend beyond the browser, potentially gaining control over a victim’s machine. Zenity disclosed these findings to the affected companies, with some issuing fixes and others arguing the behavior was intended. This research highlights a new class of security risks in the evolving landscape of AI-powered browsing.