Pwning Agentic Browsers with PleaseFix - A New Vulnerability Class for 0 Click Takeover

The talk opens with the promise of agentic browsers: AI assistants that open tabs, click buttons and act inside sessions the user is already logged into. The speaker argues that this access is what makes them dangerous, since an attacker who controls the agent's instructions inherits the user's identity. The session introduces PleaseFix, an agent-targeting vulnerability class that evolves ClickFix, and Intent Collision, where attacker content is folded into the user's own request so the agent treats it as one plan.

The middle of the talk is a series of live demonstrations. Injected instructions spread across a page evaded per-scroll classifiers. WhatsApp Web was a hard block in one browser, but a direct request to the agent kept the sensitive-site warning soft and let messages be sent. A calendar invite with a hidden button made Comet read a password file from the local filesystem and send it out. Claude in Chrome ran attacker JavaScript from a cloned CDN and leaked email, and a 1Password flow was used to reset a password. The speaker also described HistoryFixing, which poisons browser history, a feature present in browsers for years, that agents treat as ground truth. Localhost access was used to reach a Jupyter notebook and open a reverse shell, after URL checks were bypassed with redirects.

The closing takeaway is that many vendor boundaries were soft, model-based, or bypassed repeatedly, and that the vendors responded differently, with one paying a bounty. The speaker's conclusion is that only deterministic, code-level controls stopped the attacks, so builders should not rely on model safety training alone.