AI
Agentic Browsers as an Emerging Attack Surface
Coding agents exploded first. Agentic browsers are next, and Zenity’s research shows they carry significant risks that the industry has not fully reckoned with. Comet, the browser agent Zenity examined, operates with full user-session access. Prompt injections are evolving to match: attackers no longer just hijack a single response, they create intent collision, slipping attacker instructions alongside user instructions so the agent acts on both at once.
Intent Collision: How Prompt Injection Evolves in Agentic AI
Zenity’s framing: every prompt injection has two intents in play. The user says “accept this meeting.” The attacker’s payload says something else. When those two instructions occupy the same context window, the agent resolves the conflict, and not always in the user’s favor. That resolution is the attack surface. The payload hides inside a calendar invite, rewrites the accept button with attacker instructions, and abuses comment internals with system reminders. The agent never sees a boundary between the two. It just acts.
Filesystem Exfiltration via Calendar Invite Prompt Injection
The attacker sends a calendar invite. The user tells Comet to accept it and prepare for the meeting, then steps away to make coffee. The payload hides in the invite, rewrites the accept button with attacker instructions, and abuses Comet’s system reminders. Comet navigates to attacker-controlled site for further instructions (04:05), picks up a second stage, then reaches the local filesystem. Comet autonomously searches and exfiltrates local files (04:40) to the attacker. No user interaction. No alerts. One calendar invite closed the loop.
1Password Credential Compromise via Agentic Browser Autocomplete
The second attack starts the same way: a malicious calendar invite, Comet told to accept and prepare. But instead of hitting the filesystem, Comet goes after 1Password. Comet logs into 1Password via autocomplete, bypassing master password (05:24) — no master password prompt, straight into the vault. Autocomplete was on, so Comet authenticated as the user, pulled the emergency kit, and had full account access. One misconfigured browser setting, and the password manager is gone.
Rethinking the Browser Security Model for Agentic AI
“Agentic browsers are untrusted entities” — Gadi Evron
Both attacks end at the same conclusion. The browser completed the task. It accepted the meeting, searched the filesystem, logged into 1Password. It did exactly what it was told, just not by the user.
“The browser is acting under your identity.” — Gadi Evron
That is the problem the current browser security model was not built for. Permissions, sandboxing, same-origin policy — none of those controls distinguish between you clicking and an agent clicking on your behalf. The industry needs to think again.
Notable Quotes
Agentic browsers are untrusted entities Gadi Evron · ▶ 6:01
The browser is acting under your identity. Gadi Evron · ▶ 6:20
they were the first ones to actually do a zero-click attack in this space and it was a real one, not one that marketing claimed was zero click Gadi Evron · ▶ 6:48
Key Takeaways
- Agentic browsers inherit full user identity — treat them as untrusted code executing in your session.
- A single calendar invite is sufficient to chain prompt injection, site redirection, and filesystem exfiltration without user interaction.
- Demand human-in-the-loop controls and a rethought browser security model before deploying agentic browsers in enterprise environments.