The Only Boundary That Held Against an AI Browser Agent Was One Line of Code

Zenity Labs spent days trying to get ChatGPT Atlas to click the final purchase button on an Amazon order. They never managed it. That button is a hard limit written into the code, and it was the only defense in the entire project that held. So the researchers stopped attacking it and asked Amazon's own shopping assistant, Rufus, to place the order instead. Rufus complied. The wall never broke. It just stopped mattering.

That single detail, published on August 5, 2026 and presented at Black Hat USA, is the most useful thing in this year's AI browser agent research for anyone who has to decide whether staff can run one of these tools.

What the research actually covered

Zenity Labs published two chains under the name PleaseFix. One targeted ChatGPT Atlas, OpenAI's agentic browser. One targeted the official Claude extension for Chrome. Both required zero clicks from the victim.

The Atlas chain started with a comment planted under a popular post on X. A victim asks their agent to do something completely ordinary with that thread, and the planted comment redirects it. In one demonstration the agent opened WhatsApp Web, read the victim's contact list, and sent phishing messages to everyone on it, from the victim's own account. In another it filled an Amazon cart, changed the delivery address to the attacker's, and handed checkout to Rufus.

The Claude chain started with an email. Hidden inside a friendly-looking note were invisible text and fabricated conversation turns. Nothing fired until the victim asked the agent to summarize recent emails. From there the chain ran through a benign-looking package import hosted on an attacker-controlled registry, then into the victim's Gmail, then into Google Drive, where every file was silently shared with the attacker as a writer. That sharing survives a password change, a session revocation, and a 2FA reset. Reset codes arriving in the same inbox then gave the researchers Slack, X, and Claude.ai itself.

Soft boundaries are labels, not access controls

Atlas was, by Zenity's own assessment, the most hardened agentic browser they tested. It shipped with real defenses. The instructive part is what those defenses turned out to be made of.

The on-page classifier judged roughly one screenful at a time, so the researchers spread the payload thinly across scroll sections and no single snapshot ever looked bad enough to trip it. The prompt-injection classifier was tuned for English, so the same instructions rewritten in Hebrew slipped past. The sensitive-site check fired on navigation but not on where the agent already was. The confirmation gate lived in the system prompt, so a strong enough framing pre-answered it.

Every one of those is a model making a judgment about whether something looks bad. Zenity's framing for the attack class is intent collision: the agent has no reliable way to separate what the user asked from what the page said, so an attacker who bridges the two gets the agent to pursue their goal while it believes it is serving the user. Judgment is exactly what that technique is built to fool.

The purchase button was different. It was deterministic, it lived in code, and it did not care how good the story was.

Why the vendors are not shipping a fix

Zenity reported the Claude findings to Anthropic through HackerOne on December 27, 2025. The report was closed as informative on January 27, 2026, and Anthropic said it was ineligible for its disclosure program. The Atlas findings went to OpenAI on January 11, 2026, and OpenAI acknowledged them on February 17, 2026, describing meaningful risks associated with prompt injection in agentic environments and calling resilience to it an active area of work.

Reading that as vendor indifference gets the situation backwards. Anthropic published its own research on browser prompt injection in November 2025, reported real measured improvement, and then stated that a one percent attack success rate still represents meaningful risk and that no browser agent is immune to prompt injection. The attacker in that evaluation got one hundred attempts per environment. Those two numbers belong side by side in any risk write-up.

The reason there is no patch is older than any of these products. The Same-Origin Policy has spent three decades keeping a script on one site from acting inside your session on another. An agentic browser is not a script trapped in one origin. It is a single actor spanning every open tab, already authenticated everywhere you are. Cross-site request forgery comes back for free, because acting as you across origins is not a trick the attacker has to pull. It is the design.

What a manager should take from this

The practical lesson is not that these tools are unusable. It is that you should stop counting confirmation prompts and safety classifiers as controls when you write up your risk. They raise the attacker's cost, which is worth something. They are not access control.

The controls that behave like the Amazon purchase button are the boring ones: which accounts the agent can reach, which browser profile it runs in, and who is permitted to run it at all. An agent signed into your email, your client portal, and your billing system at the same time has the reach of your most access-rich employee and a documented inability to tell your instructions from an attacker's. Split the profile, and the blast radius collapses no matter what the agent reads.

Then write it down, because a rule that lives in one person's head does not survive staff turnover or a busy Tuesday.

I wrote a longer version for regulated firms, covering how NIST SP 800–171 and the HIPAA Security Rule already reach this without anyone rewriting a control, plus the five controls to put in place this week.