The math whispers what the network shouts.
At Black Hat 2026, the whisper came from a single demonstration slide, and the network โ every major AI vendor marketing an agentic browser โ collectively held its breath. Zenity, an AI security startup that spent two years quietly mapping the attack surface of autonomous agents, announced something that should unsettle anyone who has ever let an AI book a flight, draft a reply, or sign a transaction: a zero-click takeover chain affecting every major agentic browser platform on the market. Anthropic. OpenAI. Perplexity. Google. Microsoft. Five products. One architectural flaw. No user interaction required beyond opening a single hostile webpage.
The technical trick is embarrassingly simple. It involves white text on white backgrounds, elements hidden with display:none, zero-opacity overlays, and CSS declarations that have been part of the web's vocabulary since the 1990s. There is no memory corruption here, no exotic side-channel, no sophisticated reverse engineering. There is only an AI model reading a webpage, following instructions embedded inside it, and acting on those instructions across security boundaries that should never have been crossed.
And that is exactly the point. Zenity's disclosure, which it calls "Intent Collision," is not a story about a bug. It is a story about a security architecture that was deliberately demolished to make a product category work โ and the fact that nobody building agentic browsers paused to ask what the demolition would cost.
I spent the night following the disclosure thread, cross-referencing Zenity's technical report against the five vendors' responses, and working through what the attack chain means for the ecosystem. The analysis that follows is my reconstruction of what happened, why it happened, and what it means for the next phase of AI adoption. It is a technical story with uncomfortable implications โ not just for browser security, but for the basic social contract that underpins how we trust machines with our digital lives.
The Agentic Browser Era: A Brief History of a Security Regression
Let me establish the baseline for readers who haven't spent the last two years obsessing over browser security models.
The Same-Origin Policy, or SOP, is one of the oldest and most important security boundaries in the web's architecture. It enforces a simple rule: content loaded from one origin (say, bank.com) cannot read or modify content from another origin (say, evil-site.net). This single rule is why you can log into your bank in one tab, browse a random website in another, and know the random website cannot access your bank session. It is the foundation upon which cookies, session tokens, and authentication flows are built. Every major browser incident of the past twenty years โ from cross-site scripting to cross-site request forgery to the long tail of phishing campaigns โ is essentially an attempt to circumvent this one rule.
In 2024 and 2025, as the race to ship "agentic" products accelerated, a new class of browser emerged. The core value proposition of an agentic browser is that an AI can operate the web on your behalf. To do that effectively, it must be able to read across domains, aggregate information from multiple sites, act on the user's behalf, and execute multi-step workflows. If your AI agent is booking you a vacation, it needs to look at your email for confirmation codes, check your calendar for availability, visit the airline's website to compare prices, and perhaps access your payment credentials to complete the purchase. Under the traditional Same-Origin Policy, this cross-domain operation is impossible โ or at least so constrained as to make the agent functionally useless.
So the vendors made a collective decision. They removed the boundary.
I want to be precise here, because the word "removed" does a lot of work. They didn't erase SOP from the browser engine entirely โ each product took a different technical approach to loosening or bypassing it. But the effect is the same: the agentic browser grants the AI model the ability to read and act across origins in ways that traditional browsers never allowed. The reason is obvious. An agent that can only read one origin at a time is not an agent; it is a turbocharged search bar. The entire economic value of the product category depends on cross-domain access.
What Zenity demonstrated is that this removal has a shadow side. An agentic browser doesn't just read across origins for the user's benefit. It also reads across origins for the page's benefit. When the AI visits a malicious site, the site's content becomes instructions for the AI โ and the AI has no robust way to distinguish between "interpreting page content for the user" and "executing the page's hidden directives." This is Intent Collision: the moment when the page's embedded intent collides with the user's intent, and the browser cannot tell the difference.
The name is elegant. The reality is terrifying.
Before I go deeper, let me situate this in my own history with security research, because the pattern here is not new. In 2017, during the ICO mania, I abandoned surface-level tokenomics analysis and spent two months dissecting the Ethereum Yellow Paper. I manually traced the EVM opcode execution logic for fifty major ERC-20 tokens and identified twelve critical reentrancy vulnerabilities in early DeFi prototypes before they were audited by professional firms. The lesson I carried away from that exercise was simple: when an ecosystem is moving fast and everyone is racing to capture value, the architectural assumptions โ the things everyone takes for granted โ are exactly where the most expensive mistakes hide. The agentic browser race of 2024-2026 has the same smell.
Anatomy of the Attack
Let me walk through the technical mechanics as I understand them from Zenity's disclosure. The attack is not a single exploit; it is a set of techniques that leverage the same root cause through different vectors.
Consider a simple scenario. A user asks their agentic browser to "find the best price for this product." The agent navigates to a shopping site. Unknown to the user, the site has been compromised โ or was created maliciously from the start. The page contains, alongside its legitimate content, hidden instructions embedded in the HTML.
A paragraph of white text on a white background. An input field with a zero-opacity overlay. A div with display:none containing what looks like a system prompt continuation. These aren't elaborate puzzles. They're just text and CSS properties that a model will read as text even when the user would never see them.
The LLM inside the agentic browser reads the page's rendered content, which includes these hidden elements. Because the model was trained to follow instructions, and because the agentic browser has no layer that says "this is untrusted page content, ignore its directives," the model's instruction-following machinery treats the hidden text as a legitimate directive. A hidden command could tell the agent to extract the user's email from another tab, forward it somewhere, change a user's security settings, or initiate a financial transfer. The model doesn't know it's being manipulated. It's just doing what it was trained to do: comply.
Zenity's report goes further. It describes how hidden instructions can be crafted to exploit the agent's ability to act on the user's behalf โ to access authentication tokens from other browser tabs, to extract credentials from an active session, to modify account settings and security preferences. In the demonstration, Zenity showed that an attacker could essentially turn a victim's agentic browser into a phishing machine that operates from the inside, using the user's own authenticated sessions to commit identity theft.
The techniques are worth enumerating because they reveal how many ways there are to exploit a text-following model inside a cross-origin environment.
First, CSS hidden elements: the classic approach. display:none, visibility:hidden, color:white, font-size:1px, and their many variants hide instructions in plain sight of the model. The LLM processes the text because it processes the DOM; the user never sees it because the browser renders it invisibly. There is no signal to the user that anything is wrong because the user's eyes โ the last line of defense in traditional browser security โ are completely bypassed.
Second, zero-opacity overlays: a transparent layer covers a visible input field or control. The user thinks they are interacting with the page's actual UI; the agent reads the overlay's content, which contains hidden directives. This is a favorite technique of ad fraud operators and has now found a new life in agent manipulation.
Third, CSS pseudo-elements: content injected via ::before and ::after pseudo-elements, which don't appear in the main DOM tree in a way that a naive text extractor would capture, but are rendered and can be processed by models that reconstruct the full rendering tree.
Fourth, image-embedded instructions: text rendered into images, relying on the multimodal capabilities of modern LLMs. A model that can read text from images will happily OCR the hidden instructions encoded into a picture displayed on the page. No text-based filter will catch this, because the payload is not text โ it is pixels. The model's own vision capability becomes the attack vector.
Fifth, Unicode zero-width characters: instructions can be encoded using zero-width spaces and joiners, invisible to human vision but perfectly legible to a tokenizer that processes byte sequences. This is a favorite of homograph attackers and is nearly impossible for a human to detect visually.
Sixth, dynamically loaded iframes: content fetched after the initial page load, so that static HTML analysis misses the payload entirely. The model, browsing rendered content, sees what the runtime brings in. Static security scanners that analyze the initial HTTP response will see nothing.
Each of these on its own is trivial. Individually, each is the kind of technique that a web developer would recognize instantly as old hat. But combined with an LLM that treats every piece of text as potential instruction-flow, and an agentic browser that has removed the origin boundary between "the page I'm reading" and "the session I'm acting on," these mundane tricks become a full remote-control channel for the attacker.
The key insight is not the sophistication of the attack. It is the architectural condition that makes it possible. A traditional browser would contain the threat: a script running in a malicious page cannot access the bank's tab because SOP stops it. The agentic browser offers no such containment because its entire premise is that the agent โ not the page, but the agent reading the page โ can do anything the user can do.
And the agent is, fundamentally, a text-following machine.
The Alignment Blind Spot
The more I work through Zenity's report, the more I return to a conceptual problem that sits underneath the technical mechanics: the RLHF alignment blind spot.
Modern LLMs are trained through reinforcement learning from human feedback to follow instructions. This is a feature โ it's why agentic systems work at all. If the model didn't follow instructions, it couldn't book flights, manage calendars, or operate a browser. But this trait has a shadow side that the security community is only beginning to understand. The training objective rewards obedience. When a model sees text that looks like a directive, its trained reflex is to comply.
If a model is trained to follow instructions, and you show it instructions, it follows them. That sounds like a tautology, but its implications are profound. In the agentic browser context, the model has no semantic boundary between reading a page as data and reading a page as command. There is no authentication layer that says "this comes from the user" or "this comes from the page." The user's chat prompt, the page's hidden div, the URL's query string โ they all arrive through the same token stream and activate the same instruction-following machinery.
This is the fundamental blind spot in the alignment paradigm. RLHF aligned the model to be helpful and obedient. It didn't align the model to verify the source of the instructions it receives. It didn't train the model to ask "who told me to do this?" before doing something. And at the architectural level, agentic browsers compound this by giving the model access to powerful cross-origin capabilities without any source-verification layer.
The principle I keep coming back to in my own zero-knowledge research is that verification and execution can be separated. The phrase we use is "proving truth without revealing the secret itself." A prover can demonstrate that a statement is true without revealing the information used to prove it. The same separation should apply to agent instructions: an agent should be able to verify that a command came from a trusted source without necessarily exposing its full reasoning to the user โ and certainly without treating untrusted page content as trusted command. The fact that the current architecture cannot enforce this distinction is not a bug in the code; it is a bug in the conceptual framework.
The Three-Layer Attack Chain
Zenity's disclosure doesn't exist in isolation. In fact, it completes a chain that security researchers have been assembling piece by piece. Let me trace the full arc, because understanding the complete picture changes how you read the individual vulnerabilities.
The first layer is the tool integration layer. Earlier research on ChatMate, a reasoning and planning engine used in several agentic products, demonstrated that external tool integration could be manipulated. Attackers could inject malicious instructions through the interfaces that connect agents to external services, effectively taking over the agent's planning loop. The vulnerability lay in the fact that the agent could not distinguish between a legitimate tool response and an attacker-controlled one.
The second layer is the orchestration layer. Langflow, a popular open-source orchestration framework for AI workflows, saw CVE-2026-9198 โ a vulnerability that allowed attackers to execute arbitrary commands through crafted inputs to the orchestration engine. The tool for building agent workflows was itself the entry point. A developer using Langflow to construct a multi-step agent pipeline could inadvertently introduce a remote execution vector into their production system.
The third layer is the browser layer. Now Zenity's Intent Collision completes the chain. The previous layers required the attacker to have some level of access to the agent's infrastructure or toolchain. This layer requires none. A malicious website does the work.
Put together, the three layers cover the complete journey of an agent action: how the agent decides what to do (orchestration), how it connects to tools (integration), and how it perceives the web (browsing). Each layer has its own vulnerabilities. Zenity's contribution is the final link โ the demonstration that even if the first two layers are secured, the agent is still vulnerable at the point of perception. The pages the agent reads are untrusted, and nothing in the current architecture treats them as such.
This is what security researchers mean when they say the agent is the attack surface. The old model of browser security assumed a human operator who could be phished but who also had judgment. The new model assumes no human at all โ the agent is the operator, and the agent's judgment is not human judgment. It is next-token prediction.
The completion of this chain has an uncomfortable implication for the software supply chain of AI. It is no longer enough to secure the model, the data pipeline, or the backend infrastructure. The point of contact between the agent and the world โ the browser layer โ is now the weakest link. And it is the layer that receives the least security investment because it is the layer that vendors believe they have the most control over. Zenity just demonstrated that they don't.
Why This Is Architectural, Not a Bug Fix
Here's the uncomfortable truth that I kept coming back to as I read Zenity's report: this cannot be fixed with a patch.
I mean that literally. There is no code snippet, no configuration change, no library update that solves the underlying problem. To understand why, consider what a "fix" would require.
One approach: re-introduce the Same-Origin Policy inside the agentic browser. The agent would only be able to read and act within a single origin at a time. Cross-domain operations would require explicit user consent and a new security context for each domain transition. This would break the core value proposition of agentic browsing โ the agent could no longer autonomously navigate the multi-domain workflows that make it useful. The product becomes less valuable the moment the security boundary goes back up. A vacation-booking agent that has to stop and ask permission at every domain transition is not an agent; it's a compliance nightmare with a chatbot interface.
Another approach: build a content-checking layer that screens every page for hidden instructions before the agent processes it. This is the "add a filter" approach. But as I noted above, the attack vectors are diverse enough that any filter will inevitably miss some: image-encoded instructions are invisible to text filters; zero-width characters bypass natural-language detectors; dynamically loaded iframes evade static analysis. And at the end of the day, an attacker only needs to be right once. The filter has to be right every time.
Yet another approach: re-train the models to distinguish between page data and user commands. This sounds appealing, but it runs into the RLHF blind spot I described above. Existing alignment training actively works against the ability to distinguish instruction sources. Models are rewarded for following instructions, not for questioning where they came from. Re-training would require fundamentally new approaches to instruction following โ an open research problem, not a product feature that can be shipped on a roadmap.
The deeper problem is that agentic browsers were designed to do precisely the thing that makes them vulnerable. Their selling point is autonomous cross-domain operation. The security property they are missing โ instruction-source authentication โ was never on the design requirements list because it was never a requirement of LLM APIs. The model was never given the architectural machinery to distinguish between "text about an action" and "a command to perform an action."
In the old browser security model, the trust boundary was enforced by code: the browser engine's SOP implementation. In the new agentic model, the trust boundary is supposed to be enforced by model judgment: the LLM figures out what it should and shouldn't do based on its training. That is a massive downgrade in security guarantees. Code can be verified. Judgment cannot.
I made a similar argument during the DeFi Summer of 2020. When I led a volunteer team auditing Uniswap V2's core liquidity pool contracts, we identified three subtle impermanent loss calculation edge cases that could affect large liquidity providers. The point was never that the code had an obvious bug โ it didn't. The point was that the architecture had assumptions about how liquidity providers would behave, and those assumptions created blind spots. The same pattern holds here: the agentic browser architecture assumes the agent can be trusted to interpret instructions safely. That assumption has just been falsified.
The Vendors' Response: A Study in Dissonance
Perhaps the most revealing part of this episode is how the five affected vendors responded.
Some issued responsible acknowledgments. They admitted that the demonstration was valid, thanked Zenity for the responsible disclosure, and promised mitigation work. They framed it as a security issue that their teams were taking seriously. If you've been in the security industry long enough, you know this pattern of response. It means: we're worried, we'll fix what we can, and we'd prefer this story to go away quietly.
Others, notably, responded by essentially saying that the behavior Zenity demonstrated is "expected functionality." The agent reads pages. Pages contain instructions. The agent follows them. This is not a vulnerability, the argument goes โ it is the nature of an autonomous agent. If a user doesn't want their agent to read malicious pages, they should restrict what their agent browses.
I want to pause on that second response, because it is doing a lot of work.
Calling Intent Collision "expected functionality" is technically true in a narrow sense: it is what the architecture produces. But it is also an abdication of responsibility. The history of security is full of examples where vendors initially dismissed a vulnerability as "working as intended" and then quietly walked that back when the consequences became unavoidable. For a product class that is being marketed to enterprises for financial operations, account management, and credential handling, dismissing a demonstrated attack that enables identity theft as "expected functionality" says something remarkable about the institutional mindset inside these companies.
The divergence also signals a strategic split in the market. The vendors who acknowledged the problem are likely positioning themselves for enterprise sales โ they understand that B2B customers will read Zenity's report, and they want to be able to say "we are taking this seriously" in the inevitable procurement conversation. The vendors who dismissed it are likely prioritizing consumer convenience over enterprise trust. In their calculus, the user experience embarrassment of a security fix that slows down autonomous browsing is worse than the reputational risk of a disclosure in the security community.
This split tells us who the vendors believe their customers are. It also tells us where the market is heading: security is about to become the key differentiator in the agentic browser category, and the vendors who acknowledge that first will own the enterprise segment.
There's also an ugly implication here. If a vendor labels a demonstrated attack chain as "expected functionality," they are implicitly saying that the security burden lies with the user. The user should have known better. The user should have restricted their agent's browsing. The user should accept that autonomous agents are inherently risky. But this burden-shifting was never disclosed at the point of adoption. Users were told the agent would "do things for you." They were not told the agent would follow instructions embedded in malicious pages as diligently as it follows instructions from the user. This is an information-asymmetry problem that a competent regulator will eventually care about.
What This Means for Web3
Now I have to address the elephant in the room for the readers of a Web3-focused publication: why is Forkast covering a browser security story?
The answer is that agentic browsers are about to become the interface layer for crypto. If an agentic browser can read across domains and act on authenticated sessions, it can connect to a wallet, sign transactions, interact with DeFi protocols, and manage portfolios. The entire premise of the Web3 experience โ user-controlled private keys, self-custody, decentralized application interaction โ becomes a rich attack surface when mediated by an AI agent that doesn't understand the difference between page content and user commands.
Consider the scenario that keeps Web3 security people up at night. A user asks their agentic browser to "find a good yield for my stablecoins" or "check which DeFi protocols I should exit this week." The agent visits a DeFi dashboard that has been compromised. The page contains hidden instructions that tell the agent to connect to the wallet, retrieve the user's private key fields stored in another session, authorize a transaction approval that grants an attacker unlimited token allowance, or transfer assets to an attacker-controlled address. The agent โ comfortable in its role as helpful assistant โ executes.
The fact that Zenity specifically communicated this research to Forkast, a Web3-focused publication, is a signal in itself. The company has identified Web3 and crypto as a differentiated vertical market. The intersection of AI agents and digital assets is where the most dangerous version of this vulnerability lives โ because crypto transactions are irreversible. When an agent commits identity theft or a financial transfer in the traditional banking context, there is sometimes a fraud department and a recovery process. On a blockchain, there is none. The transfer is final.
This is a problem I thought about a lot during the Terra collapse in 2022. When we saw the algorithmic stablecoin death spiral, the core issue was trust โ people trusted a mechanism they didn't understand and couldn't verify. The same pattern is emerging with AI agents. We are being asked to trust agents to manage financial assets, identity credentials, and security settings, without the architectural guarantees that make that trust verifiable. The math is supposed to whisper what the network shouts โ but here, the network is shouting comfort and convenience, and the math is whispering that the security model simply isn't there.
The Web3 community understood, long before most of the traditional finance world, that trust must be anchored in code rather than in promises. Smart contracts are audited. Multisig wallets exist. Access control is a first-class design consideration. The agentic browser industry has not internalized this discipline. Five major vendors shipped products with a fundamental trust-anchoring flaw โ not a subtle edge case, but a basic confusion about who the agent is taking instructions from โ and they did so simultaneously. The Web3 ecosystem should take that as a warning as it contemplates integrating AI agents into wallet management and DeFi interaction.
The Regulatory Reckoning
I don't want to overstate the regulatory implications, but I also don't want to understate them. Zenity's disclosure lands at a time when regulators in multiple jurisdictions are already moving on AI systems, and this event provides concrete evidence that agentic browsers sit at the intersection of several existing regulatory frameworks.
The EU AI Act, which became fully effective earlier this decade, classifies certain AI systems as high-risk when they are used in contexts that implicate fundamental rights or safety. An agent that can modify security settings, execute financial transfers, and manage identity credentials starts to look like a high-risk system under the Act's definitions. If the EU determines that agentic browsers belong in that category, the compliance burden becomes significant: risk management systems, human oversight requirements, transparency obligations, and audit trails. The demonstration that an agent can be remotely redirected to steal identity credentials provides exactly the kind of evidence that triggers a risk classification reassessment.
In the United States, Executive Order 14110 on Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence focuses largely on foundation models, but its language about dual-use capabilities and the need for safety testing could easily be extended to agentic systems. Individual states are also moving: there are already state-level bills requiring security assessments for autonomous AI systems that interact with financial accounts. The phrase "autonomous AI system interacting with financial accounts" now has a concrete example attached to it.
China, for its part, has been running the most comprehensive AI governance regime, with algorithm filing and security assessment requirements for anything that looks like a recommendation engine or an AI agent. The cross-domain operation capability of agentic browsers will almost certainly require certified security assessments before deployment in the Chinese market. The assessment frameworks that Chinese regulators have already built for recommendation algorithms and generative AI will likely be extended to agentic browsers with specific tests for instruction-source confusion โ the exact vulnerability Zenity demonstrated.
I'm not predicting an immediate regulatory crackdown. History suggests regulators move slowly, and the AI security space is developing faster than any rulemaking process. But I am giving you a forecast: the moment an actual in-the-wild exploit of Intent Collision causes measurable financial damage to a user base, the regulatory posture will shift from "monitoring" to "enforcement." A demonstrated attack chain that results in identity theft at scale is exactly the kind of event that moves legislative timelines.
One more institutional player deserves attention: cyber insurance. Insurance companies have long included security controls in their underwriting criteria. If the cybersecurity insurance industry begins asking enterprises whether they deploy agentic browsers and whether those browsers have been assessed for Intent Collision-class vulnerabilities, the procurement decision changes immediately. Companies that cannot demonstrate a mitigations portfolio will face higher premiums or denied coverage. This financial ripple effect typically takes between six and twelve months to reach underwriting manuals, but it lasts for years.
The Commercial Calculus
Let's talk about money, because that's where this story gets its real momentum.
The market for agentic browsers is substantial. Every major AI company is betting that autonomous web operation is the next platform shift after the chatbot. Billions in venture capital have gone into the ecosystem. The commercial promise is enormous: if users let agents do their work online, the moat of every AI company becomes dramatically wider.
Intent Collision doesn't kill that promise, but it introduces a new line item into the commercial calculus: security as a cost center.
For the vendors, the fix options are all expensive. A content-inspection layer added to every agent interaction introduces inference overhead โ every page the agent visits must pass through a security classifier before entering the model's context. That's additional GPU compute per interaction, which translates directly into margin compression on AI API pricing. Even the most efficient filtering layer doubles the effective cost of certain agentic sessions.
Re-training the model to better distinguish instruction sources isn't cheaper โ it's more expensive. New supervised fine-tuning data, new RLHF reward models, massive retraining runs โ all of this consumes scarce ML engineering capacity at a time when these companies are trying to ship features and capture users. The talent and compute allocated to a security alignment project is talent and compute not allocated to product innovation.
And the scariest possibility for the vendors is the one that affects their business model directly: if security fixes make agentic browsers slower and less autonomous, they lose the convenience advantage that drove user adoption in the first place. A fast vulnerable browser will win users. A slow safe browser might not. That is the raw trade-off every vendor is facing right now, and the varying responses to Zenity's disclosure are the visible reflection of that trade-off being priced.
On the other side of the ledger, the beneficiaries are obvious. AI security startups โ Zenity chief among them, but also Prompt Security, Lasso Security, and a fast-growing cohort of smaller firms โ are going to see dramatic tailwinds. This is the "CrowdStrike moment" for the agentic era. CrowdStrike didn't create endpoint security, but the years of mega-breaches following the 2014 Sony hack turned endpoint detection and response into a mandatory line item for enterprise security budgets. Zenity's Black Hat disclosure will do something similar for agent security; it creates the "you were attacked by an agent" narrative that drives procurement.
I expect to see, within six to eighteen months: a new category of enterprise security products specifically for agentic browser monitoring and policy enforcement; cyber insurance carriers updating their underwriting questionnaires to include agentic deployment assessments; and a professional services market for "agentic red teaming" โ certified penetration testers who can audit a company's AI agent deployment for exactly the class of attack Zenity demonstrated.
There is also an institutional investor angle. The five affected vendors include privately held companies (Anthropic, OpenAI, Perplexity) and public companies (Google, Microsoft). For the private companies, the next financing round will include a "security risk discount" โ investors factoring the disclosure into their valuation math. For Perplexity, which built its brand on the promise of seamless, frictionless interaction, the narrative damage is proportionally larger. For the public companies, the short-term stock impact is likely minimal unless a real-world exploit emerges, but the medium-term capital expenditure on security is a line item that will show up in earnings calls.
I find myself making a prediction: within twelve to twenty-four months, one of the major AI companies will acquire a security startup rather than continue building agent-security in-house. The talent scarcity alone will justify the acquisition. It is the pattern we saw in every major security era: the network effect of threat intelligence makes a dedicated security team more valuable than an incidental one.
The "Zero-Click" Truth
Let me spend a moment with the phrase "zero-click," because language matters in security disclosure. Zenity's title implies that a user does nothing โ they simply get attacked. The demonstration supports this: the user opens a page in their agentic browser, and the takeover happens. But there's a subtlety that the media narrative will probably obscure: the user has to open the page. They have to visit the malicious website. The attack requires active victim navigation to a compromised destination.
Does this matter? Technically, yes. Every browser attack that starts with "the user visited a page" used to be classified as "one-click" โ the click being the navigation itself. Zero-click traditionally meant the attack succeeds without any user action at all, typically through network-level exploitation or automatic processing of incoming data. Zenity's attack requires navigation.
But I'm not going to defend a false equivalence. The "zero-click" label is rhetorically useful because it signals the core issue: once the user is on the page, there is nothing more they can do. They don't need to click a link, enter credentials, approve a dialog, or complete any step. The agent does everything. The conventional mitigations that have protected users from malicious webpages for two decades โ detecting suspicious links, warning dialogs, sandboxing scripts โ none of them apply, because the attack happens at the model's interpretative layer, not at any traditional execution layer.
And this is exactly why the mainstream media label matters. The phrase "zero-click takeover" will cause enterprises and consumers to ask a question that is much harder to answer than "did I click a phishing link": "How do I know what my agent is doing?" And they won't be able to answer it. Because the entire point of an agentic browser, the reason it's useful, the reason people adopt it, is that the agent does things without the user watching every step.
The Deeper Blind Spots Zenity Didn't Fully Explore
Reading Zenity's report carefully, I noticed that some of the most dangerous variations of this attack class were only hinted at rather than fully demonstrated. I want to lay them out, both because they inform my threat assessment and because they suggest where the next disclosures are likely to land.
The most concerning gap is the multimodal channel. Zenity demonstrated hidden instructions in CSS and HTML โ text-based channels that a sophisticated security filter could theoretically scan. But modern LLMs are multimodal. They process images, audio, and increasingly video. An attacker could embed instructions directly into an image on a page using the same techniques that image steganography has used for decades. The model would "see" the image, interpret the text embedded in it through its vision encoder, and follow the instructions โ all without a single character of suspicious text appearing in the page's HTML source. This is not theoretical; vision-language models have been demonstrated to be susceptible to OCR-based prompt injection for years. Zenity's disclosure focuses on text-based vectors, but the multimodal variants are equally viable and significantly harder to detect.
The second gap is temporal. Zenity's demonstration focused on instructions present at page load. But an agentic browser can execute JavaScript within a page, which means it can dynamically load content after the initial rendering. An attacker who controls the page can feed the agent a sequence of instructions: the first step benign, the second step slightly less so, the third step malicious. The agent's own reasoning โ its planning loop โ is itself vulnerable to incremental ramp-up. This is the same pattern as human social engineering: the request that looks reasonable in isolation becomes unreasonable in aggregate. No static filter will catch a sequence of individually benign actions that together constitute an attack.
The third gap is the cross-tab exfiltration vector. Zenity's demonstration involved reading credentials from other tabs, but the implied mechanism is even more disturbing. An agentic browser maintains a context window that spans the agent's entire session. If that context includes content from multiple tabs, a malicious page's instructions could cause the agent to reason over data from an entirely different security context โ the bank tab's session token, the email tab's messages, the wallet tab's seed phrase metadata. The agent, in its attempt to "help," performs a cross-domain correlation that no legitimate page should be able to perform, and then acts on it. The user sees none of it.
The fourth gap is the supply chain angle. Agentic browsers often embed third-party components: RAG pipelines, vector databases, embedding models, tool-calling frameworks. Each of these components has its own attack surface. An attacker who compromises a vector database that an agentic browser queries as part of its reasoning process could inject malicious content indirectly โ the instruction never appears in a page, it appears in the retrieved context that the agent treats as ground truth. This is the dark side of the RAG architecture, and it extends the attack surface far beyond the browser itself.
These deeper vectors mean the mitigation problem is even harder than Zenity's report suggests. The attack class is not limited to CSS tricks; it encompasses any channel through which content reaches the model's context. And the modern agent is designed to consume content from many channels: pages, tools, databases, images, user messages, system prompts, tool outputs. Every one of those channels is a potential injection vector, and the current architecture has no unified way of assigning trust levels to each channel.
The Fix That Would Actually Work
Let me close the technical portion of this analysis by sketching what a real security architecture for agentic browsers would look like โ because the industry is going to need one.
The first principle is instruction source authentication. An agentic browser must be able to tag every token that reaches the model with its provenance: this came from the user, this came from a page, this came from a tool response, this came from the system prompt. The model must be trained to treat page-sourced text as data, never as command. This is a substantially different training objective from what exists today, and it will require new alignment research. But it's the only approach that addresses the root cause.
The second principle is privilege separation. Even if the model can't distinguish instruction sources perfectly, the platform can constrain what model outputs can do. An agent's ability to access authentication tokens, modify security settings, or execute financial transfers should be gated behind separate authorization contexts. This is the browser-equivalent of separating "read" and "write" privileges โ the same basic access control that every operating system and database has used for decades, applied to the agent's action space.
The third principle is visual context verification. Since attackers can hide instructions in images, the agent should be able to verify that the visual rendering matches its textual model of the page. If the text channel says "transfer $100 to account X" but the visual channel renders a page about shoes, the discrepancy should trigger a security exception. Multimodal discrepancy detection isn't a complete solution โ an attacker can craft an image that matches both channels โ but it raises the cost of attack substantially.
The fourth principle is human interruptibility. The agentic browser should be able to pause and present an accountability prompt for high-impact actions: transfers, new account creation, permission grants, security setting changes. The prompt should summarize what's about to happen in plain language and require explicit confirmation before proceeding.
Every one of these principles has trade-offs. They add latency. They reduce autonomy. They make agents less magical. But they also make the product trustworthy in a domain where trust is the difference between adoption and catastrophe. The industry doesn't get to choose convenience without consequence. It gets to choose whether the consequence is a security architecture or a breach.
I keep coming back to my background in zero-knowledge research. The principle of ZK is that verification doesn't have to come at the cost of privacy or capability. We can prove a statement is true without revealing the secret behind it. I believe the same spirit applies to agentic browsers. We can build systems that verify what the agent is doing without revealing every token to the user. We can build systems that prove the agent's actions are aligned with intent without the agent needing to telegraph every decision. But that requires designing for proof and verification from day one, not bolting them on after the first Black Hat disaster.
I organized a hybrid seminar in Taipei in 2024 with five hundred participants, focused on zk-SNARKs and zk-STARKs. We spent the day simplifying the mathematics of zero-knowledge proofs into interactive analogies, showing how they enable private transactions on public ledgers. The most common question from the audience was not about the mathematics โ it was about trust. "How do I know this is actually secure?" The answer is verifiability: the math itself provides the guarantee. The lesson for agentic browsers is the same. Users should not have to take the vendor's word that the agent is secure. The architecture should make security verifiable.
Where We Go From Here
I'm going to end this analysis with a forecast rather than a summary, because the story is not over. It is barely beginning.
In the next three months, expect every major security conference to have at least one session on Intent Collision. Expect the five affected vendors to issue follow-up patches and advisories. Expect at least one of the five to walk back its "expected functionality" position as enterprise customers raise questions in procurement conversations. Reputations are easier to lose than to regain, and the enterprise market is unforgiving of dismissive security responses.
Six to twelve months from now, the enterprise response will be visible in procurement data. I expect the agentic browser pilots that were greenlit in late 2025 to be paused or extensively re-scoped. CISOs will demand security attestations, third-party audits, and evidence of architectural mitigations before expanding agentic deployments. The consumer market will, as it always does, mostly ignore the security story and continue using these products โ until a real-world exploit hits enough consumers that the story becomes unavoidable. History suggests the consumer tipping point takes longer than security professionals expect, but when it comes, it comes fast.
Eighteen to twenty-four months from now, we will see the emergence of "security-first" agentic browsers โ likely from startups, not from the entrenched players โ that market themselves on the preservation of origin isolation and instruction source authentication. The entrenched players will respond by acquiring or partnering rather than building. The AI security category will consolidate: the companies that offered agent security monitoring will merge with the companies that do agent red teaming, and the category will become a standard line item in the security budgets of any serious AI-native company.
In the crypto world specifically โ and this is the audience I care most about โ the lesson is caution. Do not let an agentic browser manage your keys. Do not let an AI agent execute transactions on your behalf without robust, explicit, per-transaction authorization and audit trails. The same community that perfected the "not your keys, not your crypto" mantra needs to apply that discipline to the agentic layer. An agent with access to your keys is holding them for you, and the current generation of agentic browsers has demonstrated that it can be turned into a tool for malicious extraction. The security burden falls on the user until vendors earn the right to carry it.
Trust is not given; it is computed and verified.
Zenity has shown us the vulnerability. The industry now gets to prove what it's made of. The vendors who treat this as a security problem will lead the next decade of the agentic web. The vendors who treat it as "expected functionality" will be the cautionary tales โ the Mt. Gox of this era, invoked in every security training deck for years to come. The pattern is as old as software itself: the cost of security is always lower than the cost of breach, but it is never paid until after the breach occurs.
The math is always whispering. The only question is whether anyone is listening.