Zenity Labs disclosed a new vulnerability class at Black Hat on August 5 that it calls Intent Collision — a zero-click attack vector that hijacks agentic browsers by injecting hidden instructions into any web page the agent visits. The demonstration compromised Claude in Chrome, Gemini, Perplexity Comet, ChatGPT Atlas, and Copilot Edge without requiring the user to click anything, download anything, or take any action beyond visiting a compromised page.
The vulnerability exploits a fundamental design tradeoff. Agentic browsers dismantle the Same-Origin Policy (SOP) — the security boundary that has isolated web origins for three decades — to allow AI agents to operate across websites on behalf of the user. Intent Collision turns that erasure into an identity theft class. An attacker embeds invisible instructions in a page — using techniques like white text on white backgrounds, zero-opacity overlays, or CSS-hidden elements — and the agent executes them as if they were the user’s commands.
Zenity’s research demonstrated concrete account takeover scenarios: the injected instructions could instruct the agent to extract authentication tokens from other browser tabs, exfiltrate email contents, initiate financial transfers, or modify security settings — all without the user’s knowledge. As Michael Bargury, co-founder and CTO of Zenity, told Forkast: “Agentic browsers are trading away decades of hard-won security engineering for convenience. Browsers rely on SOP to isolate any random website you visit from using your logged in banking account. Agentic browsers dismantle that security boundary.”
The attack vector is particularly dangerous because it exploits the core value proposition of agentic browsers. The entire point is to give the AI agent access to everything the user can access — that is what makes it useful. But that same cross-origin capability is exactly what Intent Collision weaponizes. The sandbox escape is not external; it is built into the architecture. The agent’s own permissions become the attack surface.
This finding extends the agent-as-attack-surface arc from the infrastructure layer to the browser layer. ChatMate RPE showed how prompt injection could compromise the agent’s external tool integrations. Langflow CVE-2026-9198 demonstrated how the orchestration layer itself could be exploited. Intent Collision completes the attack chain: even if the agent’s tools are secure and its orchestration is hardened, the browser layer — where the agent reads, interprets, and acts on web content — remains wide open.
The vendor response varied sharply. Some platforms acknowledged the findings and committed to mitigation. Others characterized Intent Collision as intended functionality — the natural consequence of giving an AI agent browser-level access. This split response is itself a signal: the industry has not converged on whether cross-origin agent capability is a feature or a vulnerability. Until it does, every agentic browser ships with an implicit zero-click identity theft class built into its core architecture.