Agent security dominated Black Hat USA 2026 this week. Zenity Labs demonstrated PleaseFix, a family of zero-click exploit chains that hijacked five major agentic browsers — Anthropic's Claude in Chrome, Google's Gemini in Chrome, Perplexity Comet, OpenAI's ChatGPT Atlas, and Microsoft's Copilot Edge — from a poisoned email, calendar invite, or social post. Check Point disclosed 11 vulnerabilities in the agent frameworks enterprise teams build on, including those from Microsoft, Google, LangChain, and CrewAI. And a July espionage attack on Thailand's Ministry of Finance showed an off-the-shelf agent running unattended inside a real intrusion. The through line: agent security is an architecture problem, and the fixes are design decisions, not patches.
Key takeaways
- Zero-click is real. Zenity's PleaseFix hijacked five agentic browsers with no user click or approval; hidden instructions in ordinary content acted with the victim's identity and permissions.
- The frameworks carry classic bugs. Check Point found 11 flaws — deserialization, SSRF, path traversal — across LangChain, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK.
- Attackers already run agents. An off-the-shelf Hermes agent executed post-exploitation tasks unattended in a real attack on Thailand's Ministry of Finance.
- Advisories may never reach you. Microsoft paid a $10,000 bounty for a critical pre-GA framework flaw but issued no CVE, so scanners will not flag it.
- The fixes are architectural. Least-privilege scopes, human sign-off on consequential actions, and untrusted-input handling for web content are design requirements, not hardening afterthoughts.
How PleaseFix hijacks an agentic browser
Zenity Labs researchers Michael Bargury and Stav Cohen planted malicious instructions in content an agent routinely reads — emails, calendar invites, social posts. Through a technique they call Intent Collision, the hidden instructions redirect the agent to act with the victim's identity and permissions. No click. No approval dialog. The victim does nothing at all.
The demonstrated impacts were concrete. A single email triggered Gmail exfiltration and account takeover through Claude in Chrome. One poisoned calendar invite yielded filesystem access and 1Password credential compromise through Comet's agent-authorized password manager workflows. A social link triggered WhatsApp phishing and fraudulent purchases through Atlas.
Bargury's point: browsers rely on same-origin policy to keep a random website away from your logged-in accounts, and in his words, "agentic browsers dismantle that security boundary." Vendor responses varied — some patched, others declined and called the behavior intended functionality. That split matters most for operators: you cannot assume the vendor treats this attack class as a bug.
Why the flaw is the layer, not the prompt
Check Point researchers Yarden Porat and Shahar Tal disclosed 11 vulnerabilities, some critical, across LangChain, LangGraph, CrewAI, AutoGen, Microsoft Agent Framework, and Google ADK, reported by The Register on August 5. These are not prompt injection variants. The flaw classes are old ones — insecure deserialization, server-side request forgery, path traversal, use-after-free — sitting in framework internals like memory stores, planning loops, and serialization layers. Some are exploitable without any tool access.
Two examples show the stakes. A critical Microsoft Agent Framework flaw allowed remote code execution through checkpoint deserialization: one user's injected payload executed when another user rewound their session. Microsoft paid a $10,000 bounty but issued no CVE because the framework was not generally available. A Google ADK flaw allowed file writes and code execution through an unauthenticated HTTP API; Google paid $3,133.70 and shipped a partial fix.
The researchers' core argument: a bug in an agent framework is not a bug in one product — it is a bug in the layer an entire category of AI applications runs on. That puts agent frameworks in your SBOM, patching, and vendor-risk processes like any other dependency. It also exposes a gap: pre-GA frameworks can pay bounties without publishing advisories, leaving scanners blind.
If an agent can act on anything it reads, then everything it reads is attack surface.
Agents are already running real intrusions
This research would matter less if agentic tradecraft were still theoretical. It is not. In July, Hunt.io identified attack infrastructure targeting Thailand's Ministry of Finance — three open directories hosted in Hong Kong, active July 9–13, holding exploit code, webshells, HTTP tunnels, and scripts with hardcoded stolen credentials.
The operator ran Hermes, an open-source assistant from Nous Research released in February 2026 and designed for mail and task automation, in its documented "YOLO" mode — the setting that disables per-command permission prompts — so the agent executed post-exploitation tasks unattended. A previously undocumented implant named Hades was staged in 62 copies. Credentials and session tokens were harvested; there was no confirmed evidence of data exfiltration as of the latest reporting.
The lesson is simple and uncomfortable. The same legitimate agents your teams are piloting become unattended attack operators with one flag flip. Expect commodity attackers, not just nation-states, to wield them.
What operators should change now
None of this argues against deploying agents. It argues against deploying them with browser-era assumptions. Five controls follow directly from the research:
- Treat agentic browsers as a distinct endpoint category. They need their own allowlist policy. An employee running one logged into corporate email, calendars, and a password manager is one poisoned invite away from account takeover.
- Scope permissions to the task, not the user. An agent that reads calendars does not need send rights, filesystem access, or password manager integration.
- Require human sign-off on consequential actions. Sends, purchases, credential access, and file writes should never execute on the agent's judgment alone.
- Treat web content as untrusted input. Anything an agent reads can carry instructions. Design so that reading a thing never authorizes an action.
- Make auto-approve modes a governance red line. Add agent frameworks to your SBOM and vendor-risk reviews, and flag any unattended mode in internal tooling assessments.
These are scoping decisions. In our engagement model — Scope → Build → Operate — permission boundaries and approval gates are set before any code is written. Retrofitting them after an incident is the expensive path.
We flagged this direction in July, when an AI agent ran a breach end to end. Black Hat made it the industry's headline problem. For how we scope agent permissions and approval gates in practice, see our agent automation work. If you are putting agents in front of production systems this year, book a consult.