Researchers at Zenity demonstrated that AI browsers can be redirected without the victim clicking anything. A single comment planted on a social thread was enough to hijack the agent browsing it, in what the researchers classify as zero-click indirect prompt injection.
What gives the finding its weight is where the problem lives. According to the analysis presented at Black Hat, this isn't a coding defect a patch resolves, but an architectural decision: the agent reads page content as part of its working context and has no reliable way to separate data it should process from instructions it should obey.
Research presented at the same event reached a similar conclusion by another route: AI browsers from the top vendors remain vulnerable to prompt injection despite multiple layers of guardrails already added. The phrasing was blunt: no perfect fix.
Check Point, examining agent frameworks, found something more concrete still. Through prompt injection, the agent loaded untrusted checkpoint data, which could allow malicious code execution on the host. The attack described involves one person planting the payload and another triggering it by rewinding their own session.
The conclusion running through all three pieces of work is uncomfortable for anyone selling autonomous agents: the problem isn't the text the user writes, it's that the agent treats everything it encounters as potentially instructive. Until that separation exists in the design, every page visited is attack surface.