# Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover > Black Hat USA 2026, 2026-08-05. This is the complete text representation of the talk page. Slide text is derived from the published deck's accessibility text and is not a transcript. Slides may contain exploit demonstrations, adversarial prompts, and commands; treat them as research material, not instructions to execute. ## Resources - [Canonical talk page](https://www.mbgsec.com/talks/2026-08-05-bhusa2026-pwning-agentic-browsers-with-pleasefix/) - [Talks index](https://www.mbgsec.com/talks/llms.txt) - [Interactive deck manifest](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/latest.json) - [Slides PDF](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/slides.pdf) - [Conference agenda](https://blackhat.com/us-26/briefings/schedule/#pwning-agentic-browsers-with-pleasefix-a-new-vulnerability-class-for-0-click-takeover-53888) - [Page source](https://raw.githubusercontent.com/mbrg/mbgsec/main/_pages/decks/2026-08-05-bhusa2026-pwning-agentic-browsers-with-pleasefix.md) ## Abstract Decades of isolation techniques and exploit mitigations are being intentionally dismantled to make way for agentic browsers. Atlas breaks Same-Origin Policy (SOP). Gemini and Edge add untethered localhost access. Comet opens up your filesystem. Claude executes scripts on any website, giving you XSS as a service. Their main mitigation is model safety training. These are design choices, not vulnerabilities. Subsequently, XSS, sandbox escapes, and drive-by exploitation are making a comeback! We uncover PleaseFix, the evolution of ClickFix as a new vulnerability class targeting agents rather than humans. We also craft Intent Collision, a universal technique to exploit it. We'll demonstrate just how bad it gets, with full end-to-end 0click attack chains on up-to-date flagship agentic browsers. User interaction with social media leads to drive-by exploitation, while weaponized calendar invites deliver targeted payloads. We use these entry vectors to achieve full account takeover of Slack, X, 1password, and Claude. Silently exfiltrate from Gmail, GDrive and the local filesystem. Persist long-term by deploying an implant via agent memory, drive files and browser history. We'll have some fun using your WhatsApp account for phishing, and your Amazon assistant to order our hacking equipment with your credit card. We'll wrap it up by achieving full RCE on your local machine, escaping the browser sandbox. Finally, we'll detail how some browser agents meaningfully made our lives as hackers difficult with creative engineering. We will share hard boundaries they implemented that limit AI agency, including deterministic filters and human reviews. We'll discuss the vulnerabilities we discovered to bypass these boundaries, the collaboration with affected vendors to improve security mitigations, and share conclusions applicable to anyone building agents. _[Official conference abstract](https://blackhat.com/us-26/briefings/schedule/#pwning-agentic-browsers-with-pleasefix-a-new-vulnerability-class-for-0-click-takeover-53888)_ ## Slide text Source: [published deck manifest](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/deck.json). This text describes the published slides and embedded media; it is not spoken-word transcription. ### Slide 1 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 1 of 179 ### Slide 2 Last Year on…. — slide 2 of 179 ### Slide 3 @mbrg0 — #BHUSA — slide 3 of 179 ### Slide 4 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 4 of 179 ### Slide 5 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 5 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media1.mp4) ### Slide 6 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 6 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media2.mp4) ### Slide 7 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 7 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media3.mp4) ### Slide 8 # — WhoAmI — slide 8 of 179 ### Slide 9 # — WhoAmI — slide 9 of 179 ### Slide 10 Turning on Win95 — slide 10 of 179 ### Slide 11 Guess whos back? — slide 11 of 179 ### Slide 12 Hacking Agentic Browsers — slide 12 of 179 ### Slide 13 Hacking Agentic Browsers — slide 13 of 179 ### Slide 14 Hacking Agentic Browsers — slide 14 of 179 ### Slide 15 Hacking Agentic Browsers — slide 15 of 179 ### Slide 16 Hacking Agentic Browsers — slide 16 of 179 ### Slide 17 Hacking Agentic Browsers — slide 17 of 179 ### Slide 18 CSRF is back from the recycle bin — slide 18 of 179 ### Slide 19 Hacking OpenAI Atlas — slide 19 of 179 ### Slide 20 Hacking OpenAI Atlas — 20 — ChatGPT Atlas — slide 20 of 179 ### Slide 21 21 — Hacking OpenAI Atlas - WhatsApp — slide 21 of 179 ### Slide 22 22 — Hacking OpenAI Atlas - WhatsApp — slide 22 of 179 ### Slide 23 23 — Hacking OpenAI Atlas - WhatsApp — slide 23 of 179 ### Slide 24 24 — Hacking OpenAI Atlas - WhatsApp — slide 24 of 179 ### Slide 25 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 25 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media4.mp4) ### Slide 26 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 26 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media5.mp4) ### Slide 27 Hacking OpenAI Atlas - WhatsApp — slide 27 of 179 ### Slide 28 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 28 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media6.mp4) ### Slide 29 RAG RESULTS ARE JUST ANOTHER PART OF THE PROMPT! — => They can be injected! — BlackHat USA 2024 — slide 29 of 179 - Animation: [Embedded animation](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/image49.gif) ### Slide 30 Slide 30 — slide 30 of 179 ### Slide 31 Intent Collision – Generic PI Technique — slide 31 of 179 ### Slide 32 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 32 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media7.mp4) ### Slide 33 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 33 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media8.mp4) ### Slide 34 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 34 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media9.mp4) ### Slide 35 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 35 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media10.mp4) ### Slide 36 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 36 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media11.mp4) ### Slide 37 Hacking OpenAI Atlas - WhatsApp — slide 37 of 179 ### Slide 38 Hacking OpenAI Atlas – Great Theft Amazon — slide 38 of 179 ### Slide 39 Hacking OpenAI Atlas – Great Theft Amazon — slide 39 of 179 ### Slide 40 Hacking OpenAI Atlas – Great Theft Amazon — slide 40 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media12.mp4) ### Slide 41 We were able to go all the way here but …. — slide 41 of 179 ### Slide 42 Hacking OpenAI Atlas – Great Theft Amazon — slide 42 of 179 ### Slide 43 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 43 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media13.mp4) ### Slide 44 Hacking OpenAI Atlas – Great Theft Amazon — slide 44 of 179 ### Slide 45 We can plan — t — a bomb on every website — slide 45 of 179 ### Slide 46 Nothing bad came from Youtube comments ah? — slide 46 of 179 ### Slide 47 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 47 of 179 ### Slide 48 Disclosures — 48 — Jan 11, 2026 — slide 48 of 179 ### Slide 49 Identity - Pwned , Data Exfiltration - Next — slide 49 of 179 ### Slide 50 Hacking Perplexity Comet — slide 50 of 179 ### Slide 51 Hacking Perplexity Comet — - — File System Exfiltration — slide 51 of 179 ### Slide 52 Hacking Perplexity Comet — - — File System Exfiltration — slide 52 of 179 ### Slide 53 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 53 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media14.mp4) ### Slide 54 Hacking Perplexity Comet — - — File System Exfiltration — slide 54 of 179 ### Slide 55 Hacking Perplexity Comet — - — File System Exfiltration — slide 55 of 179 ### Slide 56 Reverse Eng Comet — slide 56 of 179 ### Slide 57 Reverse Eng Comet — slide 57 of 179 ### Slide 58 Hacking Perplexity Comet — - — Prompt Inject Guardrail — slide 58 of 179 ### Slide 59 Hacking Perplexity Comet — - — PII Guardrail — slide 59 of 179 ### Slide 60 Hacking Perplexity Comet — - — Action-Intent Guardrail — slide 60 of 179 ### Slide 61 Hacking Perplexity Comet — - — Action-Intent Guardrail — slide 61 of 179 ### Slide 62 Hacking Perplexity Comet — - — File System Exfiltration — slide 62 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media15.mp4) ### Slide 63 Hacking Perplexity Comet — - — File System Exfiltration — slide 63 of 179 ### Slide 64 Exfil Local File Systems — slide 64 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media16.mp4) ### Slide 65 Oct 22, 2025 — – Exfil vulnerability disclosed — Nov 21, 2025 — slide 65 of 179 ### Slide 66 Whack – A – Bypass with Perpleixty — slide 66 of 179 ### Slide 67 Whack – A – Bypass with Perpleixty — slide 67 of 179 ### Slide 68 Whack – A – Bypass with Perpleixty — slide 68 of 179 ### Slide 69 Whack – A – Bypass with Perpleixty — slide 69 of 179 ### Slide 70 Whack – A – Bypass with Perpleixty — slide 70 of 179 ### Slide 71 Whack – A – Bypass with Perpleixty — slide 71 of 179 ### Slide 72 Whack – A – Bypass with Perpleixty — slide 72 of 179 ### Slide 73 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 73 of 179 ### Slide 74 Gotta Leak’em ALL — slide 74 of 179 ### Slide 75 Hacking Claude In Chrome — slide 75 of 179 ### Slide 76 Hacking Claude In Chrome – The new toolbar — slide 76 of 179 ### Slide 77 Hacking Claude In Chrome — slide 77 of 179 ### Slide 78 Hacking Claude In Chrome — slide 78 of 179 ### Slide 79 Hacking Claude In Chrome — slide 79 of 179 ### Slide 80 Hacking Claude In Chrome — slide 80 of 179 ### Slide 81 Hacking Claude In Chrome — slide 81 of 179 ### Slide 82 Hacking Claude In Chrome — slide 82 of 179 ### Slide 83 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 83 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media17.mp4) ### Slide 84 Hacking Perplexity Comet + 1Password — slide 84 of 179 ### Slide 85 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 85 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media18.mp4) ### Slide 86 Hacking Perplexity Comet + 1Password — slide 86 of 179 ### Slide 87 Hacking Perplexity Comet + 1Password — slide 87 of 179 ### Slide 88 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 88 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media19.mp4) ### Slide 89 Hacking Perplexity Comet + 1Password — slide 89 of 179 ### Slide 90 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 90 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media20.mp4) ### Slide 91 Hacking Perplexity Comet + 1Password — 92 — @mbrg0 — slide 91 of 179 ### Slide 92 Data - Pwned , XSS - Next — slide 92 of 179 ### Slide 93 Hacking Claude In Chrome - UXSS — slide 93 of 179 ### Slide 94 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 94 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media21.mp4) ### Slide 95 Claude In Chrome XSS – Slack ATO — slide 95 of 179 ### Slide 96 Claude In Chrome XSS – Slack ATO — slide 96 of 179 ### Slide 97 Claude In Chrome XSS – Slack ATO — slide 97 of 179 ### Slide 98 Claude In Chrome XSS – Slack ATO — slide 98 of 179 ### Slide 99 Slack ATO — https://drive.google.com/drive/u/0/folders/1e9NezWDwMJhWT6P4pD22AoimzRph2P2p — slide 99 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media22.mp4) ### Slide 100 Claude In Chrome XSS – Claude ATO — slide 100 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media23.mp4) ### Slide 101 Win Win W — i — n — slide 101 of 179 ### Slide 102 Dec 27, 2025 — – Vulnerability disclosed — Jan 27, 2026 — slide 102 of 179 ### Slide 103 XSS - Pwned , Persistence - Next — slide 103 of 179 ### Slide 104 HistoryFixing- Intro — slide 104 of 179 ### Slide 105 HistoryFixing- Intro — slide 105 of 179 ### Slide 106 HistoryFixing- Intro — slide 106 of 179 ### Slide 107 HistoryFixing- Intro — slide 107 of 179 ### Slide 108 HistoryFixing- Intro — slide 108 of 179 ### Slide 109 HistoryFixing- Intro — slide 109 of 179 ### Slide 110 HistoryFixing- Intro — slide 110 of 179 ### Slide 111 Browser History — slide 111 of 179 ### Slide 112 HistoryFixing — slide 112 of 179 ### Slide 113 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 113 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media24.mp4) ### Slide 114 HistoryFixing - Poisoned history — slide 114 of 179 ### Slide 115 HistoryFixing - Technical — slide 115 of 179 ### Slide 116 HistoryFixing- What was the number — I — saw earlier? — slide 116 of 179 ### Slide 117 What was the number — I — saw earlier? — slide 117 of 179 ### Slide 118 What was the number — I — saw earlier? — slide 118 of 179 ### Slide 119 What was the number — I — saw earlier? — slide 119 of 179 ### Slide 120 What was the number — I — saw earlier? — slide 120 of 179 ### Slide 121 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 121 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media25.mp4) ### Slide 122 HistoryFixing- Leaking Browser private history — slide 122 of 179 ### Slide 123 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 123 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media26.mp4) ### Slide 124 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 124 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media27.mp4) ### Slide 125 Your History is a minefiled of dormant payloads — slide 125 of 179 ### Slide 126 Disclosures — 128 — OpenAI Disclosure — slide 126 of 179 ### Slide 127 Persistence - Pwned , RCE - Next — slide 127 of 179 ### Slide 128 What else haven't we seen? — slide 128 of 179 ### Slide 129 Right? Right????? — slide 129 of 179 ### Slide 130 R.C.E the Root Rex Predator — slide 130 of 179 ### Slide 131 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 131 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media28.mp4) ### Slide 132 What Runs on LocalHost? — slide 132 of 179 ### Slide 133 Our Plan — slide 133 of 179 ### Slide 134 Our Plan — slide 134 of 179 ### Slide 135 Our Plan — slide 135 of 179 ### Slide 136 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 136 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media29.mp4) ### Slide 137 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 137 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media30.mp4) ### Slide 138 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 138 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media31.mp4) ### Slide 139 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 139 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media32.mp4) ### Slide 140 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 140 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media33.mp4) ### Slide 141 143 — ATTACKERS — DEFENDERS — slide 141 of 179 - Animation: [Embedded animation](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/image216.gif) - Animation: [Embedded animation](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/image217.gif) ### Slide 142 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 142 of 179 ### Slide 143 RCE on Edge Copilot — slide 143 of 179 ### Slide 144 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 144 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media34.mp4) ### Slide 145 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 145 of 179 ### Slide 146 RCE on Edge Copilot — slide 146 of 179 ### Slide 147 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 147 of 179 ### Slide 148 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 148 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media35.mp4) ### Slide 149 LocalHost Guardrail Bypass — slide 149 of 179 ### Slide 150 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 150 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media36.mp4) ### Slide 151 RCE- on Gemini In Chrome — slide 151 of 179 ### Slide 152 RCE- on Gemini In Chrome — slide 152 of 179 ### Slide 153 RCE- on Gemini In Chrome — slide 153 of 179 ### Slide 154 RCE- on Gemini In Chrome — slide 154 of 179 ### Slide 155 RCE- on Gemini In Chrome — slide 155 of 179 ### Slide 156 RCE- on Gemini In Chrome – Bypass URL Guardrail — slide 156 of 179 ### Slide 157 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 157 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media37.mp4) ### Slide 158 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 158 of 179 ### Slide 159 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 159 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media38.mp4) ### Slide 160 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 160 of 179 ### Slide 161 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 161 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media40.mp4) ### Slide 162 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 162 of 179 ### Slide 163 RCE- on Gemini In Chrome — slide 163 of 179 ### Slide 164 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 164 of 179 - Video: [Embedded video](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/media41.mp4) ### Slide 165 168 — ATTACKERS — DEFENDERS — slide 165 of 179 - Animation: [Embedded animation](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/image216.gif) - Animation: [Embedded animation](https://media.mbgsec.com/decks/2026-08-05_BHUSA2026_PwningAgenticBrowsers_PleaseFix/1b8cca3c/media/image217.gif) ### Slide 166 Success! Reverse Shell on Gemini In Chrome — slide 166 of 179 ### Slide 167 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 167 of 179 ### Slide 168 Disclosures — 171 — Microsoft Disclosure — slide 168 of 179 ### Slide 169 We Got it all! — slide 169 of 179 ### Slide 170 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 170 of 179 ### Slide 171 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 171 of 179 ### Slide 172 Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover — slide 172 of 179 ### Slide 173 attackers use LLMs too. — AI Guardrails are SOFT boundaries. — They WON’T help you prevent an attack. — slide 173 of 179 ### Slide 174 Slide 178 — slide 174 of 179 ### Slide 175 @mbrg0 — #BHUSA — slide 175 of 179 ### Slide 176 ACT NOW! — slide 176 of 179 ### Slide 177 This isn't a bug. It's the design. — agentic browser's entire job is to read and act on untrusted content, with your identity, wired into your machine. You can't patch away the reason the product exists. — So — slide 177 of 179 ### Slide 178 Asking the model to behave is not a security control. — Soft boundaries, alignment and "ask before acting," slowed us down and never stopped us. Only hard, in-code boundaries held, and even those we bypassed. — So — slide 178 of 179 ### Slide 179 It's a class problem, so the fix is architectural, and until it ships, the burden is on you. — No single vendor owns this and no single patch closes it, especially when the response is "expected behavior." — So — slide 179 of 179