Black Hat has always been that stage where what seemed like science fiction becomes reality in real time. 😅
And at the 2026 edition, the topic that dominated the hallways was just one: the AI agents you use every day might be exposing you in ways you never imagined.
We are not talking about some distant or purely theoretical scenario. We are talking about the tools that companies like OpenAI, Anthropic, and Google have been pushing hard since last year — the ones that book flights, browse websites, open files, check emails, fill out forms, and schedule appointments for you.
These connections are practical, fast, and make total sense for anyone looking to save time. But there is a detail that usually flies under the radar: every permission you grant to an agent is also a door that, if poorly exploited, can be used against you.
Two studies presented during the conference shed light on exactly this, showing in practice how data manipulation techniques and exploitation of access permissions can turn a useful tool into a sophisticated attack vector. And the most concerning part: without you having to click on anything suspicious.
The question that remains is simple: do you know what your agents can do with what you have already authorized?
Why giving access to an agent is so convenient (and so risky)
Let us be fair here. Connecting an AI to handle tasks is incredibly handy. In Outlook or Gmail, for example, you can ask it to find a specific email or summarize your pending messages. Granting access to Google Drive helps find and analyze documents, and enabling the calendar lets it organize meetings without any effort on your part.
You can even go further and give it access to your operating system to manage files. The problem is that, like almost everything in life, this convenience can come at a steep cost down the road.
That is exactly what two studies demonstrated during Black Hat USA 2026, one of the most important cybersecurity conferences in the world. They put on the table what can happen when these capabilities are manipulated by someone with bad intentions.
In one of them, researchers from Zenity managed to hide instructions inside everyday content — from a social media comment to a calendar invite — to hijack browsers equipped with AI agents and make them act against their own users.
Receive the best innovation content in your email.
All the news, tips, trends, and resources you're looking for, delivered to your inbox.
By subscribing to the newsletter, you agree to receive communications from Método Viral. We are committed to always protecting and respecting your privacy.
The other one, presented by Palo Alto Networks, found a different path. A manipulated spreadsheet allowed them to take control of the protected environment where ChatGPT processes files and, from there, alter the task the system was executing.
The two projects stem from different techniques, but they bump into the same problem: the more an agent can do on someone’s behalf, the more damage it can cause if someone manages to manipulate it.
It is worth noting that this discussion ran through much of Black Hat and also DEF CON, the two big conferences that make up the so-called Hacker Summer Camp in Las Vegas, where artificial intelligence showed up both as a tool for finding vulnerabilities and as a new attack surface.
A simple comment can hijack an entire agent
As Stav Cohen, a researcher on Zenity’s AI security team, explained, the landscape has changed quite a bit. In the old world, an attack usually required you to do something risky — like clicking on a malicious link, downloading a file, typing your password on a fake page, or approving a shady permission. The so-called zero-click approach means that step simply disappears.
The research, titled Pwning Agentic Browsers with PleaseFix: A New Vulnerability Class for 0-Click Takeover, studied a new generation of browsers that incorporate agents capable of performing tasks autonomously. OpenAI itself launched one last year, which ended up being discontinued.
In a traditional browser like Chrome, Edge, or Safari, you are the one who decides which page to open, where to click, which form to fill out, or which message to send. An agentic browser, on the other hand, receives a goal — like booking a flight or signing up for a service — and executes the necessary steps on its own.
Where the danger in that autonomy lives
The problem arises because, to carry out those tasks, the agent also needs to read the content it encounters along the way. That is where an attacker can introduce instructions aimed at the AI — a technique known as indirect prompt injection. The malicious command does not come directly from the user but is hidden inside a page, an email, a document, or any other content processed by the agent.
As Cohen put it, attackers hide instructions inside the content the agent reads, and the agent cannot reliably distinguish between the content it was asked to analyze and the instructions hidden within it.
The researchers named this class of attack PleaseFix and developed a technique called Intent Collision, which blends the legitimate task requested by the user with the intent introduced by the attacker.
One of the demonstrations started from a completely ordinary situation. The researchers left hidden instructions inside a comment on X (formerly Twitter), under a post about a newsletter. When the victim asked the browser to sign up, the agent also read the comment.
From there, they managed to make the AI abandon the original task, go to Amazon, change the shipping address, and make purchases sent to the attacker’s address. In another version, the agent opened WhatsApp and sent messages to the victim’s contacts.
The scariest case involved passwords
The reach of these attacks grows because these browsers can use the sessions the person already has open. In testing, Zenity managed to take over accounts on Slack, X, 1Password, and Claude, access information from Gmail and Google Drive, use WhatsApp to send messages, and Amazon to make purchases.
One of the most sensitive examples involved 1Password, a password manager. The researchers managed to get the agent to use the victim’s own extension to hand over the password vault to the attacker and then lock the legitimate user out of their own access.
They also initiated a password recovery procedure on a service, had the agent automatically retrieve the recovery email, and completed the password change from the same session. All of it automated — because that is what sets an agent apart from a simple AI chatbot.
According to the team, a traditional browser is just a viewer. All of web security was built on the premise that a human is the one making the decisions. An agentic browser replaces that human with an AI agent that decides for you, as if it were you, on every site where there is an active session.
For Cohen, the only defense that actually worked was one where the model had no decision-making power. The recommendation is to set explicit limits on the resources an agent can reach and require human intervention for specific sensitive actions.
Breaking into the vault where ChatGPT opens your files
The other research, from Palo Alto Networks, started from a different scenario: what happens behind the scenes when a user uploads a file to ChatGPT and asks for an analysis. Something that has become routine, since it is common for people to upload medical records or ask for analysis of accounting files.
The work was presented by Simcha Kosman, a researcher at the company. Sherrod DeGrippo, Vice President of Threat Intelligence at Unit 42, explained the scope of the attack.
When ChatGPT needs to analyze a spreadsheet or run calculations, it uses an isolated temporary space known as a sandbox. Think of it as a locked room where the system does its work without anything affecting the rest of the infrastructure. As DeGrippo put it, each sandbox needs to be isolated, like a separate sealed room.
How the vault was cracked open
The researchers prepared a specially crafted Excel spreadsheet that allowed them to take control of that environment. Once inside, they found a way to alter the instructions ChatGPT was receiving during the task, making the system fetch information the person had never asked for.
And here the issue of access permissions comes back with full force. If the user had connected their email, cloud storage, or another service to ChatGPT, the attacker could potentially request information from that service — within the limits of the permissions granted.
The attack was not the same as stealing a ChatGPT password, nor did it automatically open all of an account’s conversations. What it did was exploit capabilities the system already had available. ChatGPT is designed so that one conversation cannot read the text of another, but once the environment was compromised, the attacker could use the account-level capabilities the user had already authorized.
There was still one obstacle: even with access to information, the sandbox was designed to prevent the free sending of data to the internet. The team then discovered an internal mechanism shared between environments and used it as a rudimentary transmission channel. DeGrippo compared the process to sending a message in Morse code — through a sequence of states representing ones and zeros.
The good news is that Palo Alto Networks reported the vulnerability to OpenAI before disclosing it publicly, and the company eliminated the shared mechanism that enabled that communication. The specific technique can no longer be used that way.
What this means for anyone using agents day to day
The discussion raised at Black Hat is not an argument against using AI agents. These tools have real value — they save time and help manage workflows that would be impossible to handle manually. The point is that using them responsibly requires a periodic review of the access permissions you have already granted.
Platforms like Google, Microsoft, and Apple let you view and revoke access at any time, and doing so regularly is one of the most straightforward ways to reduce exposure to the kind of data manipulation demonstrated in the research. DeGrippo recommended treating these connections like permissions for any powerful application: enable only what is necessary, grant the lowest level of access possible, and periodically review which services remain connected.
Another relevant aspect is understanding that the risk is not only in third-party agents but in the data they process. A document received from an unknown source, processed by an agent with broad access to your digital environment, already represents a possible entry vector. Cybersecurity in this context starts looking less like antivirus software and more like digital hygiene: knowing what comes in, what goes out, and who has permission to touch what.
AI agents promise to simplify steps — searching, deciding, and executing tasks to take the heavy and boring work off your plate. The two studies from Black Hat showed the other side of that convenience: the more access agents receive, the greater the risk involved. Convenience always has a price, and the era of AI being used for everything is only beginning to reveal its risks. 🚨
