Black Hat USA

Agentic browsers are dismantling decades of browser security by design, reintroducing attacks like XSS, sandbox escapes, and drive-by exploitation. We'll reveal PleaseFix, the evolution of ClickFix targeting AI agents, and Intent Collision, a universal exploitation technique, demonstrating zero-click attack chains that compromise leading agentic browsers to take over accounts, exfiltrate sensitive data, establish persistence, abuse trusted applications, and ultimately achieve remote code execution outside the browser sandbox. We'll also examine the security boundaries that actually slowed us down, the techniques we used to bypass them, our collaboration with affected vendors, and the key lesson for anyone building or deploying AI agents: traditional browser security assumptions no longer hold, agentic browsers should be treated as highly privileged software with access to your digital identity, and meaningful protection requires deterministic, code-enforced boundaries rather than relying on AI model alignment alone.

This talk exposes eight hidden assumptions embedded in modern security architectures; assumptions that are laid bare in adaptive, goal-driven systems. We'll discuss a systems-based lens for security leaders and architects to: Recognise when your controls are structurally incapable of working, Reason about agentic risk using the four dynamics that shape the behaviour of all systems (control, decision-making, flow, feedback), and Derive controls that constrain causes, rather than reacting to behaviour.

The AI agent supply chain has become a fertile ground for malware. It lurks in skill markdown files, rug-pulled MCP servers, misaligned models, and weaponized moltbook posts. In a blink of an eye, we find ourselves with an outdated supply chain security model. Intelligence gathering based on build-time static scanning has been sidestepped by agents pulling, writing, and executing code at runtime. Standing on the shoulders of giants, we introduce an old-new approach: agent detonation chamber. Analysis based on kernel-level truths, not a wishful analysis by an LLM judge. We detonated tens of thousands of skills from public marketplaces, and uncovered hundreds of malicious skills. We'll reveal how cryptominers and infostealers blinded static scanning tools with trivial "these aren't the droids you're looking for" instructions, remaining undetected for months until we spotted them.

Everyone's asking whether attackers are actually going after AI systems yet. We stopped guessing and went looking. We built a global network of AI honeypots, hundreds of decoy AI servers and agents spread across clouds providers and regions, and watched who showed up. What we caught: attackers stealing compute to run their own AI workloads on our bill, turning AI tools' own features into weapons to forge server-side requests, attempts to run code and steal secrets, and even pointing autonomous hacking agents and "jailbroken" personas at our exposed AI decoy backends to attack 3rd parties, and more. This research shows real attacks, prompts, and techniques that threat actors used, and what it means for anyone deploying AI.

Coding agents slash delivery times for development teams and boost output quality, but only if operated securely. Running on user endpoints, coding agents can leak local files, invoke insecure tools, or adopt unauthorized skills. Without any hard code, threat actors can hijack coding agents and invoke risky activity directly inside an organizations production database. In this talk, see how coding agents can easily chain privilege escalation to accomplish nefarious goals, and how to prevent them from going rogue.

Agentic security isn't hard because it's new. It's hard because it breaks the assumptions our security models are built on. We keep trying to secure agents when what's actually needed is to govern agency, and those are fundamentally different problems. This talk exposes eight hidden assumptions baked into modern security architectures, ones that adaptive, goal-driven systems expose ruthlessly, and offers security leaders a systems-based lens to spot controls that are structurally incapable of working, reason about risk through the four dynamics that shape all systems (control, decision-making, flow, feedback), and build controls that constrain causes instead of chasing behavior.

Agentic browsers represent a new manifestation of AI risk. With persistent access and long horizon goals, the threat vectors for Claude in Chrome are innumerous and frequently changing. In this talk, see how Claude in Chrome is built, broken, and requires hard boundaries built in code, not training

Agentic browsers are tearing down decades of web security to enable AI autonomy: breaking Same-Origin Policy, granting raw localhost and filesystem access, and running scripts on any site, with model alignment as the only real defense. We introduce PleaseFix, a new ClickFix-style vulnerability class that targets agents instead of humans, and Intent Collision, a universal technique to exploit it, then chain them into full 0-click attacks on flagship agentic browsers achieving account takeover, data theft, persistent implants, and remote code execution. We also break down which defenses actually held, and why code-enforced boundaries beat model training every time. Walk away with concrete hardening steps you can apply today, no vendor patch required.