Intent Collision Proved It: Your AI Browser Agent Is a Design Flaw, Not a Patch Problem

In August 2026, researchers at Zenity Labs stood on stage at Black Hat USA and did something that should have ended the "we'll patch it" conversation for good. They took over AI browser agents — Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, Microsoft Copilot in Edge, even Amazon's AI shopping assistant — with zero clicks from the victim. No phishing link to click. No malware to install. Just an email, a calendar invite, or a post on X that the agent read on the user's behalf.

They called the technique Intent Collision. Zenity's AI security research lead, Stav Cohen, didn't call it a bug. He called it a design flaw.

He's right, and if you're building or buying an AI agent that touches a browser, your inbox, or your calendar, you need to sit with that distinction, because it changes what "fixing" this actually means.

What Intent Collision Actually Does

Here's the mechanism, stripped of the marketing: AI browser agents pull context from everything you point them at — emails, calendar invites, web pages, social posts. They cannot reliably tell trusted content (your instructions) from untrusted content (whatever text happens to be sitting in that email or invite). Hide an instruction inside the untrusted content, and the agent doesn't know it just took orders from an attacker instead of you. It still has your login session, your OAuth tokens, your identity. It just used them for someone else's goal.

Zenity's demos make this concrete, not theoretical:

• Claude in Chrome: ask the agent to summarize an email, and a hidden instruction inside that email leads to Gmail data theft, Google Drive files getting shared out, and account takeover across Slack, X, and Claude itself.
• Perplexity Comet: a poisoned calendar invite hijacks the agent, which then goes rummaging through local files and password-manager workflows.
• ChatGPT Atlas: a link embedded in an X post gets the agent to send phishing messages over the victim's own WhatsApp.
• Amazon's AI assistant: a manipulated order description results in a fraudulent charge to the victim's card.

Zero interaction. The user never clicked anything malicious. They just asked their agent to do its job.

OpenAI Basically Agrees With Zenity

This isn't just one research team being dramatic. OpenAI's own position — published after researchers showed that a few crafted words in a Google Doc could redirect ChatGPT Atlas's behavior — is that prompt injection against AI browsers will probably never be fully eliminated. OpenAI compares it to scams and social engineering: reducible, not solvable. The UK's National Cyber Security Centre said essentially the same thing. Brave issued a parallel warning the same week.

OpenAI's response is sensible as far as it goes — faster patching, continuous red-team testing, and an "LLM-based automated attacker" trained with reinforcement learning to find holes before real attackers do. That's good defense-in-depth. It is not a fix. By OpenAI's own admission, the attack surface is structural: an agent that reads untrusted content and holds your credentials in the same context window will always have some path for the two to collide.

That's not a patch note. That's an architecture decision you made when you gave the agent that scope in the first place.

Why "Ask Before Acting" Isn't the Answer Either

Zenity's recommended mitigations are worth reading closely, because none of them are "wait for the vendor patch":

• Review and disable default browser-agent settings rather than trusting them out of the box.
• Don't sign into work accounts — email, AWS, GitHub — inside an AI browser session.
• Restrict where the agent is allowed to act, deliberately, rather than letting it roam.
• Don't rely solely on "ask before acting" confirmation prompts.

That last one matters most. Confirmation dialogs assume the user can tell a legitimate action from a hijacked one in the two seconds before they click "allow." Intent Collision is specifically designed to make that judgment call impossible — the agent believes it's doing what you asked. You will approve your own compromise.

This Is a Scoping Problem, Which Means It's a Design Review Problem

Strip away the "AI" framing for a second. This is privilege scope and blast radius — the oldest problem in security architecture, wearing a new hat. The question was never "can we patch prompt injection out of existence." It's "why does an email-summarizing agent have standing access to Drive sharing, Slack, and account settings in the first place?"

That question gets answered at design time, not incident-response time. It's exactly the identity and access layer of PWNISMS — the P in Product and the I in IAM don't stop applying because the actor reading your email is a model instead of a person. If anything, they apply harder, because the agent can't exercise judgment the way a person can when something looks off.

We've written before about agent goal hijack as OWASP's #1 agentic AI risk, and about identifying and securing AI agent attack surfaces before they ship. Intent Collision is the browser-specific, zero-click version of exactly that failure mode, and it's why Captain Hook's policy enforcement approach — constraining what an agent can do at the platform layer, independent of what it believes it was told — is a design control, not a bolt-on.

A continuous threat model that actually enumerates what an agent can reach — which accounts, which data, which irreversible actions — before you wire it into a browser is the only control here that doesn't depend on the model behaving itself. Vendors will keep shipping better filters. Attackers will keep finding the gap those filters miss. Your blast radius is the one variable you actually control.

The Takeaway

Intent Collision isn't a vulnerability you wait out. It's a confirmation that giving an AI agent broad, standing access and trusting it to sort friend from foe in real time was always the wrong bet. Scope the access at design time. Everything downstream of that decision is just damage control.

‍