The Browser Removed Its Own Walls: Intent Collision and the End of Same-Origin Policy
Black Hat 2026. Zenity's researchers step on stage with a demo that empties the room of optimism. Five major agentic browsers — Anthropic's, OpenAI's, Perplexity's, Google's, Microsoft's — fall to a zero-click takeover. The vector isn't another memory corruption bug or a missing bounds check. It's a stylesheet trick. White text on a white background. A zero-opacity overlay. A div hidden behind display:none. Instructions embedded in a webpage that the AI agent silently reads and obeys — exfiltrating authentication tokens from other tabs, triggering financial transfers, rewriting security settings. Every timestamp is a potential crime scene, and this time the architects committed the crime. The product class didn't ship with a broken sandbox. It shipped with no sandbox at all. Zenity calls it Intent Collision, and the name is precise: the user's intent and the attacker's intent collide in a model that cannot tell them apart.
The agentic browser category has been the fastest-moving experiment in AI since 2024. The pitch is straightforward: an LLM operates the browser the way a human would — navigating pages, extracting data, filling forms, executing workflows across domains. Your agent cancels flights, reconciles invoices, claims an airdrop, rebalances a position across three DeFi protocols. To deliver that, it must read your email, check your bank, sign with your wallet. All in the same session. All with permission to act.
That requires cross-origin access. And cross-origin access requires dismantling the Same-Origin Policy — the isolation layer that has defined browser security for two decades. Talk to any audit engineer and they'll tell you: removing SOP is not a patch. It's a deliberate architectural decision that converts every webpage from passive content into a potential instruction source for a software agent holding credentials.
Zenity's write-up connects this finding to a longer chain. The first link is ChatMate's Remote Plugin Execution — a tool-integration layer that accepts untrusted external input. The second is Langflow's CVE-2026-9198, an orchestration-layer vulnerability disclosed earlier this year. Intent Collision is the third link, and it completes the chain: tool layer, orchestration layer, browser layer. "Agent as attack surface" is no longer an abstraction. Code does not lie; it merely waits for someone to read the entire stack.
The five affected vendors did not respond uniformly. Some acknowledged the issue and committed to mitigations. At least one described the behavior as "expected functionality." That phrase deserves attention. It's an admission that cross-origin obedience is a design principle, not a bug. The product works as intended. The intent is the problem.
Intent Collision is not a traditional implementation flaw. It's the inevitable output of a design tradeoff that traded security for capability. The agentic browser's core value proposition — "AI accesses everything you can access" — is structurally incompatible with SOP, which exists precisely to prevent one origin from accessing another. The vendors removed the boundary. This is a zero-sum exchange, and the ledger bleeds where logic fails to bind. The deficit is not a function someone wrote incorrectly. It's a threat model in which the sandbox never existed in the first place.
Sandbox escape, in the traditional browser security model, assumes a sandbox exists and might be breached. The agentic browser's model assumes a sandbox was never needed. Those are categorically different postures. Exploiting an agentic browser doesn't require a chain — the dangerous primitives are already exposed by the architecture. The agent's ability to read other tabs, carry credentials across origins, and act on what it reads is the product's feature set, exposed to anyone who can influence what the agent reads.
The technical implementations Zenity demonstrated are not novel. White-on-white text, zero-opacity overlay layers, CSS-hidden elements — these are the same tricks ad networks have used for a decade to keep content invisible to humans but present in the DOM. The difference is the consumer. A human sees nothing. A vision-language model sees everything, including instructions it was trained to follow. The attacker doesn't need exploit development skills, a jailbreak, or a sophisticated payload. They need a landing page and a basic understanding of how instruction-following models behave. Traditional zero-click exploits require complex memory corruption chains. This one requires a Webflow subscription.
The public discussion treats hidden CSS as the limit of the attack surface. It's not. Filtering display:none and color:white is a game of whack-a-mole. Text can be embedded in images and read through the model's OCR pathway. Zero-width Unicode characters can carry instruction payloads that no visual scan will catch. CSS pseudo-elements like ::before and ::after inject content into the rendered stream without leaving traces in the raw HTML an auditor checks. Dynamically loaded iframes can stage malicious content after an initial clean pass. These methods attack both the model's text channel and its vision channel simultaneously. The safe browser that could detect all of these doesn't exist yet. Anyone claiming a content filter solves this is selling confidence, not security.
The deeper structural failure is that modern LLMs are trained, via RLHF, to follow instructions. Compliance is the benchmark metric. The agentic browser links that instruction-following machinery directly to untrusted page content, with no authentication layer distinguishing a user's command from a webpage's embedded directive. The semantic boundary between "I am reading this page" and "this page is instructing me" does not exist in the architecture.
This mirrors what I found in 2020 when I traced the MakerDAO oracle failure to its exact block numbers. The ETH/USD feed was manipulable because the protocol threaded all its trust into a single source of truth without a verification layer. Everyone was panicking about the crash; I was documenting where the assumptions failed. Trust is a variable, never a constant. MakerDAO assumed the oracle was reliable. Agentic browser vendors assume the model can distinguish instruction sources. Both assumptions break under adversarial input.
It's also the lesson from 2018, when I spent ninety days manually auditing the 0x protocol v2 contracts. The critical vulnerabilities were never the flashy ones. They were the assumptions embedded in the design — the gap between the developer's mental model and the execution environment. This is the same class of flaw, one abstraction level up. The developer assumed the model would know the difference between content and command. It doesn't. It can't.
The divergence in vendor responses maps to target customers, not security competence. Firms that acknowledged the issue are positioning for enterprise buyers — CISOs who read the demo and immediately extended their procurement cycles by six to twelve months. The vendor that called it "expected functionality" is betting on consumer convenience, gambling that retail users won't read a security bulletin before the next feature drop. That bet may pay off short-term — history suggests consumers tolerate risk for convenience. But in the enterprise market, that position is a self-inflicted credibility wound that will cost more than any feature lead. Regulators are also circling. Under the EU AI Act, an agentic browser with the demonstrated ability to trigger financial transfers and alter security settings could be classified as a high-risk AI system, triggering obligations around risk management and human oversight. The disclosure gives regulators a concrete incident to cite.
The vendors who dismissed the finding as expected behavior deserve a fair hearing. Technically, they're not wrong. An agentic browser that cannot read cross-origin data cannot do its job. Re-introduce SOP-style isolation and you've removed the product's reason to exist. This is a genuine engineering dilemma, not a simple moral failure. The industry has not reached consensus on whether cross-origin agent capability is a feature or a vulnerability — and both positions have coherent backing.
The "zero-click" framing also needs scrutiny. In Zenity's demonstrations, the victim still has to navigate to the malicious page. That's a minimal trigger — a link, an ad, a poisoned search result — but it isn't literally zero user action. The distinction matters for defense. Blocking untrusted navigation, restricting the agent's initial browsing surface, and quarantining unknown domains are practical first-line defenses even if they don't solve the underlying architecture.
Finally, the fix creates a cost center no one is pricing. Adding a content-instruction verification layer before agent execution means extra inference calls, added latency, compressed margins. In a funding environment where unit economics determine valuations, that's not an engineering footnote. It's a business model question. The market may reward the vendors who delay fixes to protect margins — at least until the first major exploitation event. Then the calculus flips.
For the Web3 ecosystem, this is the clearest signal yet: stop wiring AI agents to wallets. The demo scenario — token extraction, financial transfer, security-setting modification — is the exact kill chain that empties a DeFi position. Reputation is liquid; solvency is binary. Until someone builds an instruction-provenance layer that distinguishes user intent from page content, no autonomous agent should hold keys, sign transactions, or manage positions. The ledger bleeds where logic fails to bind. This time, the logic failed at the architectural level — and it will fail again until the industry treats it as such.