Intent Collision: The Architecture-Level Backdoor in Every Major Agentic Browser

Most people are wrong because they keep hunting for the exploit in the wrong layer. At Black Hat on August 7, 2026, Zenity demonstrated a zero-click takeover of every major agentic browser on the market: ChatGPT Atlas, Google Project Mariner, Microsoft Copilot, Perplexity, and Anthropic Claude. The demo extracted authentication tokens from other browser tabs. It exfiltrated email. It modified security settings. It initiated financial transfers. All of it triggered by a webpage the user never touched. Zenity calls it Intent Collision. The orchestration-layer CVE is CVE-2026-9198. But I am not here to annotate a CVE. I am here to tell you what this disclosure actually means: these products are not buggy. They are designed this way. A bug can be patched. A design choice requires a product rethink. And when a security researcher tells you the flaw lives in the architecture, the market reprices the entire category. This is the agentic browser moment. Agentic browsers are the industry's attempt to turn LLMs from chatbots into autonomous operators. Instead of you clicking through websites, the AI does it for you — reading pages, filling forms, moving funds, managing calendars, executing multi-step workflows. The pitch is productivity. The reality, as Zenity proved, is that these products achieve cross-domain agency by removing the most important isolation layer in web security: the Same-Origin Policy. SOP exists for a reason. It stops a script loaded from one origin from reading or manipulating content from another origin. It is the backbone of the modern web's security model. For an agent to access whatever the user can access, it must operate across origins. That is the core value proposition. So the vendors dismantled SOP to deliver it. Zenity's Aviad Bargury said it plainly: the industry traded decades of security engineering for convenience. That trade was never disclosed to the user. Five major products, across five vendors, all built on the same bet. None shipped a sandbox. None established a security baseline. The entire category now shares the same structural hole. This is not a competition failure. It is a category failure. Let me walk through the attack, because the mechanics matter more than the vendor patches that will inevitably follow. Intent Collision works like this. An attacker publishes a webpage. On that page, they embed instructions. The instructions are invisible to the human — white text on white background, a zero-opacity overlay, elements hidden with display:none, or content injected through CSS pseudo-elements. The user navigates to the page in an agentic browser. The model reads the page. And the model cannot distinguish between content written for the human eye and instructions written for its own context window. So it follows them. The CSS tricks are the entry point, not the full attack surface. Hiding instructions from the model has far more variants than these demos suggest. Text embedded in images — the model OCRs it. Unicode zero-width characters that inject invisible strings. Dynamic iframes that load malicious content after the initial render. Pseudo-elements the human never sees but the model parses. Filtering CSS will not fix this, because the model processes both visual and textual channels, and both channels carry attacker-controlled payloads. This is the RLHF blind spot. Modern LLMs are trained to obey text. That is the foundation of instruction-following alignment. When you put an agentic browser in front of arbitrary web content, you are asking it to treat untrusted text as trustworthy. There is no authentication layer between page content and user intent. No cryptographic identity. No semantic boundary. The model cannot tell the difference between what you asked it to do and what the webpage asked it to do. The end-to-end chain matters just as much. Zenity's disclosure lands as the third link in a complete attack chain. First, ChatMate's Remote Prompt Execution — the tool integration layer. Second, Langflow's CVE-2026-9198 — the orchestration layer, where agent workflows are assembled. Third, Intent Collision — the browser layer. Put them together and you have a kill chain that covers every level of the AI agent stack. The security industry has been treating these as separate problems. They are one problem. From my own audit experience — I spent 2017 reading EOS's delegation code line by line after it ate my leveraged position — I can tell you the difference between a bug and an architecture flaw. A bug is a logic error where the design assumption still holds. An architecture flaw is when the design assumption itself is the vulnerability. Intent Collision is the latter. The assumption is that an AI agent can safely read and act on arbitrary web content. That assumption is false. It will remain false regardless of how many filter layers you bolt on top. Sandboxing makes it worse. In traditional browser security, the assumption is that the sandbox exists but might be compromised. In agentic browsers, the sandbox never existed. Zenity confirmed it: the sandbox escape is built into the architecture. You cannot patch a missing foundation. The vendors' responses are revealing. Some acknowledged the issue and promised mitigations. Others reportedly treated cross-source agent capability as an intended feature. That split is not a technical disagreement. It is a market positioning signal. The vendors who acknowledged the problem are chasing enterprise customers who demand security. The vendors who shrugged are chasing consumer convenience. Both are making a bet. Only one of those bets survives a procurement review. Now let's puncture the media narrative. Zero-click sounds catastrophic — and it is severe — but strictly, the user still has to navigate to the attacker's page. There is a micro-interaction at the front of the chain. That does not diminish the risk, but it changes how you think about exposure. The darker framing is that the attacker requires zero technical skill. No exploit development. No memory corruption. Just HTML and CSS. That lowers the attacker bar to any malicious website operator on the planet. The attack surface is not elite hackers. It is the entire adversarial web. The second blind spot: consumer markets will not react. History is consistent. Chrome extension privilege abuse, mobile app overreach, browser zero-days — consumers absorb these and keep using the product because convenience outranks abstract risk. The real damage will land on enterprise adoption. CISOs evaluating agentic browser pilots will freeze. Procurement cycles will stretch six to twelve months. Security review becomes an adoption gate. If you are an enterprise buyer, you just received a gift: a reason to say no. For the Web3 crowd specifically, Zenity's choice to brief a blockchain-focused outlet is not noise. It is a signal. Web3 is the vertical most sensitive to identity theft and asset transfer, because the asset is the key. If you connect an agentic browser to a wallet, or let an AI agent manage DeFi positions, you are handing your secrets to a system that cannot distinguish between your command and a malicious page's command. I learned that lesson shorting Terra in 2022: when the architecture allows the flaw, the flaw gets exploited. Trust the code, verify the chain, own the outcome. Do not let an agent hold your keys. The market read is equally clear. This disclosure resets the investment narrative for the entire category. The affected platforms — Anthropic, OpenAI, Perplexity, Google, Microsoft — will absorb a security-risk discount in future negotiations, and the discount is steepest for the small, convenience-first players. Meanwhile, AI security becomes a standalone product category: browser-layer content inspection, instruction-origin verification, and agent red-teaming. Expect ten to twenty percent of enterprise AI-agent budgets to migrate to that protection layer within the next year. Zenity just gave itself the best sales deck in the industry. We do not predict the storm; we build the ship. The storm is here. The next six to eighteen months are the window in which AI agent security becomes a real category, in which a security-first agentic browser wins enterprise trust, and in which every vendor with a fix runs damage control in the marketplace of perception. The question is not whether fixes ship. The question is whether the fixes degrade the product. If security means removing cross-domain capability, you just removed the reason the product exists. Hype is a liability; liquidity is the only truth. In security, trust is liquidity. The agentic browser category is running on hype with a negative trust balance. Watch patch quality. Watch vendor disclosures. Watch whether the intended-feature crowd changes its tune after the first in-the-wild exploit. It will. The market should price that in now. I did not need a Black Hat talk to know that convenience without isolation is just a promise. But now we have the receipts.