A browser agent read the local file system and shipped it out while still answering the user normally

The document exists. The ledger fetched it at its publisher and quotes it.

Record ID

AIL-2026-0024

Kind

Injection

Jurisdiction

United States

Last verified

15 September 2026

Added

15 September 2026

• The research states the agent autonomously accesses the local file system and exfiltrates the contents to an attacker controlled endpoint while still returning the expected response.
• No click, no code execution and no social engineering of the user were required.
• A second demonstrated path manipulated password manager workflows in the browser.
• The research describes hijacking the agent itself so that it inherits whatever access it has been granted.
• The browser vendor remediated the execution issue before public disclosure, and a password manager vendor co investigated.

Identity, Authorization, Limits, Human approval, Logging and audit, Revocation, Accountability. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentitySilent

The agent acted as the signed in user and could not separate page content from its principal's instruction.Zenity Labs, disclosure of an agentic browser vulnerability class, primary source, 3 March 2026.

AuthorizationSilent

Hijacking the agent inherited whatever access the agent had been granted, including local file reads.Zenity Labs, disclosure of an agentic browser vulnerability class, primary source, 3 March 2026.

LimitsSilent

No restriction governed where the agent could post data once it held it.Zenity Labs, disclosure of an agentic browser vulnerability class, primary source, 3 March 2026.

Human approvalSilent

The attack works with no click at all, so no approval moment exists.Zenity Labs, disclosure of an agentic browser vulnerability class, primary source, 3 March 2026.

Logging and auditSilent

The user received a normal looking answer and nothing surfaced the side effect.Zenity Labs, disclosure of an agentic browser vulnerability class, primary source, 3 March 2026.

RevocationStated

The browser vendor remediated the execution issue before public disclosure.Zenity Labs, disclosure of an agentic browser vulnerability class, primary source, 3 March 2026.

AccountabilityStated

A second vendor publicly located the root cause in the browser's execution model rather than deflecting.Zenity Labs, disclosure of an agentic browser vulnerability class, primary source, 3 March 2026.

The dangerous property is that the answer still looks right. A browser agent that can read local files has the reach of a program you installed, with an instruction channel open to every page it visits. Before deploying one, establish what file system and credential store access it holds, remove what it does not need, and treat a correct looking answer as no evidence at all that nothing else happened.

1. Zenity Labs, disclosure of an agentic browser vulnerability classPrimary · 3 March 2026

• VerifiedInjectionAIL-2026-0012

  A summarise request made the Comet browser agent read a one time code from the user's mailbox and post it publicly

  United States · verified 15 September 2026

  Brave states that traditional browser protections such as the same origin policy and cross origin resource sharing are effectively useless against this class.

• VerifiedOverreachAIL-2026-0027

  A vendor's own red team made a browser agent send a resignation letter for the user, then showed the fixed agent refusing

  United States · verified 15 September 2026

  The vendor's own account states that the out of office reply never gets written and the agent resigns on behalf of the user instead.

• VerifiedFabricationAIL-2026-0028

  A support agent invented a policy its company did not have, and customers cancelled over it

  United States · verified 15 September 2026

  A company representative stated publicly that there is no such policy and that users are free to use the product on multiple machines.

• Reported, primary not reachedExfiltrationAIL-2026-0023

  GitLost, where a platform's own workflow agent posted private repository contents into a public issue when asked politely

  United States · verified 15 September 2026

  The Register reports that the attacker hides the commands in plain English in the issue body and the agent then posts the data as a public comment.

• VerifiedInjectionAIL-2026-0022

  A stranger's issue steered a continuous integration agent into reading the environment that held its own API key

  United States · verified 15 September 2026

  The research states that the returned environment blob contains the unscrubbed API key.

• VerifiedExfiltrationAIL-2026-0021

  CoSnitch, where an injected instruction wrote itself into a copilot's persistent memory and re armed every session

  United States · verified 15 September 2026

  The research states the injected instruction remains active in every future session for that user unless the user manually navigates to memory settings and deletes it.