Agentic Browser Security: Why Atlas, Comet & Peers Break Same-Origin Policy

An agentic browser holds every tab you're logged into at once, as one entity. That single design decision resurrects cross-site request forgery at a scale the same-origin policy was built to prevent — and it's already been demonstrated against ChatGPT Atlas and Perplexity Comet in production. Here's what's actually been disclosed, and what testing this attack surface involves.

Key takeaways

• Zenity Labs demonstrated a full zero-click indirect prompt injection against ChatGPT Atlas, including an "intent collision" attack where a single planted comment on an X post hijacked a benign user request and redirected the agent to act across other authenticated sessions.
• In March 2026, Zenity disclosed "PleaseFix," a family of critical vulnerabilities affecting multiple agentic browsers including Perplexity Comet — allowing attackers to hijack the agent and access local files. An earlier, related flaw let indirect prompting take over a user's password manager; Perplexity shipped a fix in February 2026.
• Cato Networks disclosed "WebPromptTrap" in BrowserOS — a manipulated AI summary could steer a GitHub OAuth authorization flow and gain access to developer repositories. A CVE request sat unanswered with MITRE for over three months.
• CVE-2026-0628, a high-severity flaw in Chrome's Gemini feature, let malicious browser extensions with only basic permissions hijack the Gemini Live panel.
• OWASP's March 2026 report classifies prompt injection as the highest-severity vulnerability for deployed LLMs, and found 73% of production enterprise AI deployments vulnerable to it.
• OpenAI itself has said prompt injection is unlikely to ever be fully "solved" for browser agents — this is a vendor's own public position, not outside criticism.

What an agentic browser actually is, in security terms

Strip away the product framing and an agentic browser is an AI system with one job: read what's on a page and decide what to do next, then act — click, fill a form, submit, navigate — without asking permission for each step. The pitch is that it does this across every tab you have open, and every site you're logged into, as a single continuous session.

That's also exactly the design decision that breaks the web's oldest security boundary. The same-origin policy exists so that a script running on malicious-site.com can't read or act on your session with your-bank.com. Browsers have enforced that boundary between origins for three decades. An agentic browser doesn't run inside that boundary the same way — it sits above it, as one entity that can read content on one origin and take actions on another, because from the agent's point of view both tabs belong to the same user with the same intent. Researchers studying this pattern describe it plainly: agentic browsers effectively resurrect cross-site request forgery, at the scale of everything the agent is logged into.

What's actually been disclosed — not theoretical

This isn't a hypothetical attack class. Four separate disclosures in the last several months show the same underlying pattern playing out against different products:

• ChatGPT Atlas — zero-click indirect prompt injection. Zenity Labs built a full proof-of-concept where a single planted comment on an X post created "intent collision": the agent's understanding of what the user asked for got hijacked by content it read while carrying out the task, and the attacker redirected it to act across other sites the user was authenticated into. Reported to OpenAI in late 2025 and early 2026.
• Perplexity Comet — password manager takeover. Indirect prompting manipulated Comet into taking actions against the user's password manager. Perplexity fixed it in February 2026 — but it sits in the same vulnerability family Zenity later named "PleaseFix," spanning multiple agentic browsers and allowing agent hijacking plus local file access.
• BrowserOS — "WebPromptTrap." Cato Networks found that a manipulated AI-generated page summary could steer a GitHub OAuth authorization flow, handing an attacker access to developer repositories through a workflow the user never intended to authorize.
• Chrome's Gemini Live panel — CVE-2026-0628. A high-severity flaw let a malicious extension with nothing more than basic permissions hijack the panel entirely.

None of these required a sophisticated zero-day. They required content — a comment, a summary, a page — that the agent would read as part of doing its job, crafted to redirect what it did next.

Why your existing security program doesn't cover this

A conventional web app pentest assumes a single origin and a human at the keyboard deciding what to click. Agentic browser risk breaks both assumptions simultaneously — the "application" is the agent's entire authenticated session set, and the actions it takes were decided by content it read, not a person clicking. Three structural reasons this gets missed:

• The vulnerability isn't in your app. The Comet password-manager and BrowserOS GitHub incidents didn't involve a flaw in the target site's code at all — the target site was working exactly as designed. The exploitable gap was in how the browser agent interpreted content and crossed session boundaries.
• It's procured and deployed outside security review. Agentic browsers install like any other browser extension or app — individual employees adopt them for productivity long before security teams scope a review, the same shadow-IT pattern that's driven most AI agent incidents generally.
• The vendor has already told you it won't be fully fixed. When OpenAI's own head of preparedness says prompt injection is unlikely to ever be fully solved, that's not a patch-and-move-on vulnerability — it's a permanent property of the architecture that needs standing, adversarial testing, not a one-time scan.

The adoption-versus-readiness gap

Piloting figure per Writer's Enterprise AI Adoption 2026 report; incident and budget figures per Gravitee's State of AI Agent Security 2026 report.

Read together, that's not a slow-moving risk. Adoption is already near-universal in pilot form, nearly every security team expects an incident soon, most have already had one — and budget and formal approval both lag miles behind actual usage. That gap is exactly where an agentic browser ends up installed on someone's machine with production credentials behind it, and nobody's tested what it can actually reach.

How ComplyArmor tests agentic browser exposure

This falls inside our existing AI Agents & LLM Applications attack surface — the same adversarial testing we run against any AI system that can take real actions, extended to the specific failure modes agentic browsers introduce. Every finding maps to the OWASP LLM Top 10 (2025) and OWASP Top 10 for Agentic Applications (2026), the same taxonomy referenced throughout this site.

• Cross-session boundary testing. Can content read on one authenticated origin trigger an action on another? This is the core same-origin-policy failure behind every disclosure above — LLM01:2025 Prompt Injection and ASI01:2026 Agent Goal Hijack.
• Indirect injection resistance. Planted content in comments, summaries, and pages the agent is expected to read as part of normal operation — the exact vector behind the Atlas and BrowserOS disclosures.
• Excessive agency and tool-boundary testing. What can the agent actually reach — password managers, OAuth flows, file systems — and does it stay inside the scope a task legitimately requires, mapped to ASI03:2026 Agent Identity & Privilege Abuse.
• Verified findings, not theoretical risk. Every exploitation attempt is reproduced against a live target with proof, the same standard we hold every engagement to — not a scanner report flagging a pattern match.

See the full methodology on our Attack Surface page, or how findings map to compliance frameworks on Compliance.

Before you approve an agentic browser for work use

1. Inventory who's already using one. Given how these get adopted, assume it's more people than IT knows about.
2. Scope exactly what sessions and credentials it can reach. Password managers, internal tools, anything with standing access — that's the blast radius if it's hijacked.
3. Don't treat vendor patches as closure. Comet's password-manager fix didn't prevent the later "PleaseFix" family — treat this as a class of risk requiring ongoing testing, not a bug to close once.
4. Test indirect injection specifically, not just direct prompt manipulation — the disclosed attacks all rode in on content the agent was expected to read anyway.
5. Match your security spend to actual usage, not the 6% average — if adoption is already happening, budget needs to reflect that now, not after an incident.

Frequently asked questions

The vendor building Atlas has already told you, in public, that this class of vulnerability won't be fully solved. That's not a reason to avoid agentic browsers — it's the reason testing them can't be a one-time checkbox either.