Zero-Click by Design: How Agentic Browsers Traded the Same-Origin Wall for an Open Door
At Black Hat 2026, Zenity security researcher Niv Bargury demonstrated what he called an "Intent Collision" — a zero-click takeover of every major agentic browser on the market. Not one product. Not a proof-of-concept in a lab. Every major implementation, across five platforms from OpenAI, Anthropic, Google, Microsoft, and Perplexity. Through hidden instructions embedded in rendered web pages, an attacker could extract authentication tokens from open browser tabs, exfiltrate email contents, trigger financial transfers, and silently modify security settings. All without the user clicking anything.
This is not a bug. This is architecture.
The Same-Origin Policy (SOP) has served as the load-bearing wall of browser security for over two decades. It enforces a hard rule: a script from one origin cannot read data from another origin. It is the invisible agreement that keeps your online banking session sealed from the forums open in your next tab. Agentic browsers — designed for AI agents to read pages, navigate websites, and execute tasks on the user's behalf — have deliberately demolished that wall. The capability that makes them revolutionary is the same architectural choice that makes them indefensible.
Based on my years auditing smart contracts and evaluating trust frameworks, I have learned that the most dangerous vulnerabilities carry no bad intent. The attacker does not break the code; the code breaks itself. Here, the vendors made no implementation error. They made a design trade: cross-domain productivity in exchange for the security model that made the web usable in the first place. The user was never asked to ratify that exchange.
The attack techniques are almost laughably unsophisticated. White text on a white background. Zero-opacity overlay layers. CSS with display:none and visibility:hidden. These are the building blocks of any entry-level web developer. No memory corruption, no kernel exploit, no advanced tooling. The attacker simply wraps existing CSS and HTML tricks around the instruction-following disposition of modern LLMs. As Bargury framed it, the industry traded decades of security engineering for convenience — and the trade is now settling.
The full severity emerges only when you map the attack chain. Zenity's disclosure completes a three-layer journey: ChatMate RPE at the external tool integration layer, Langflow's CVE-2026-9198 at the orchestration layer, and now Intent Collision at the browser layer. Each layer alone was concerning. Together, they define the entire attack surface of the emerging AI agent stack. Security vendors have been circling this territory individually. Zenity just drew the perimeter.
And the perimeter is larger than the vendors would like to acknowledge. The threat model assumes a sandbox exists. Existing security practices assume a sandbox might be breached. Agentic browsers shipped without a sandbox existing at all. Those are fundamentally different threat models, and the mitigation strategies derived from the first model do not transfer to the second.
There is also a structural detection problem that the current conversation is understating. Simple CSS filtering cannot catch sophisticated hidden instructions. Attackers can embed text inside images and force the model through OCR, inject zero-width Unicode characters, deploy CSS pseudo-elements like ::before and ::after, or load dynamic iframes that populate after inspection. These techniques attack both the visual channel and the text channel simultaneously. Models trained to follow text instructions have no semantic boundary between "page content to be read" and "instructions to be executed." This is an alignment blind spot — not a filtering problem.
Now the contrarian view. The "zero-click" framing dominating the headlines is technically misleading. The user must still actively open the compromised page within an agentic browser. That is a minimized trigger — but it is not nonexistent. The media will amplify panic; enterprises will respond with procurement freezes; consumers will barely react. History is consistent on this: extension permission abuses, mobile app overreach, browser zero-days — consumer convenience has always been a stronger drug than caution. The real commercial shock will concentrate in the enterprise segment, where CISOs will extend evaluation cycles by six to twelve months.
The vendors are not equally equipped to respond. Google and Microsoft command mature browser security teams able to patch at the engine level; smaller challengers are left to bolt on content filters that add inference latency and compress thin margins. That asymmetry will reshape the field more than any feature roadmap.
The fact that this story emerged through Forkast — a blockchain-focused publication — carries a message the mainstream coverage will miss. Web3 natives are the most trauma-conditioned users in the digital economy; they have been burned by smart contract exploits, bridge hacks, and private key theft for years. This disclosure lands as a direct warning: do not connect AI agents to crypto wallets, do not delegate DeFi position management to agentic browsers, do not let a model's instruction-following disposition touch assets that cannot be clawed back. The intersection of agentic AI and crypto is where one hidden prompt becomes a drained vault.
The vendor responses have been predictably split. Some acknowledged the vulnerability and committed to mitigation. Others reportedly dismissed cross-origin access as an intended feature. That divergence is not technical — it is philosophical. The first camp serves security-sensitive enterprise customers. The second prioritizes consumer convenience and rapid adoption. But calling a demonstrated attack vector an "intended feature" outsources the security risk to the user while stripping the informed consent that should accompany that outsourcing. The ethical cost has been deferred, not eliminated.
Regulation is now inevitable. Under the EU AI Act, agentic browsers capable of executing financial transfers or modifying security settings resemble high-risk AI systems, which would trigger mandatory risk management, human oversight, and transparency obligations. Executive Order 14110's dual-use framework may extend toward agentic systems. China's algorithm filing regime would demand security assessments. The vendors have raced on model intelligence and execution speed. None treated security as the baseline, which is precisely why the baseline is now being written by others.
Soulless finance is just empty pixels. But soulless security — the checkbox compliance that protects no one — is equally hollow. What this disclosure demands is not a patch but a redesign.
The industry must confront the question it has avoided: can agentic browsers restore isolation without abandoning their value proposition? The answer may require a "security mode" that operates within SOP constraints, using protocols and APIs instead of simulated web actions. That is a harder engineering problem than adding a content-scoring filter. It will increase inference costs, compress profit margins, and slow the product roadmap. It is also the only path to making agentic computing trustworthy enough to handle the tasks the vendors are selling.
The industry has not reached consensus on whether cross-origin agentic capability is a feature or a flaw. That absent consensus is itself the systemic vulnerability. Code doesn't lie, but code cannot consent. Until the builders of agentic browsers answer the question honestly, every one of them is an identity-theft corridor wearing a friendly face — and the users stepping through that corridor deserve to know what they are walking into.