StAJect0r

AI Security | We Break, We Cheer, We Protect | Find the Promptware before it finds you.
Senior AI Security Researcher @ Zenity | PhD Student @ Technion

[Michael Bargury @mbrg0]

kicking off the 3rd @zenitysec agent security summit at sf!

[Michael Bargury @mbrg0]

excited to speak about our agent detonation chamber this summer at #BHUSA!

how do you 'scan' txt for 'security badness'? not w wishful analysis by an llm judge

what we really want is: what will this thing cause my agent to *DO*?

ft/ francesco montorsi @lana__salameh @roeybc

[StAJect0r @StAJect0r]

@mbrg0 @supriza0 @p1njc70r @tamirishaysh My hands are clean ... this time.

[Michael Bargury @mbrg0]

from a security perspective agentic browsers are a very bad idea

but who cares about security we've got ai now

i'm excited to be able to demo just how bad things get on stage at #BHUSA!

incredible work by @StAJect0r @supriza0 @p1njc70r @tamirishaysh

[StAJect0r @StAJect0r]

@AmitLeViAI So any status update? I

[Michael Bargury @mbrg0]

i'm stoked to announce our lineup for the agent security summit sf 2026!

to celebrate we few more open tickets you can grab now

w keynotes from the amazing @gadievron @travismcpeak @NahamSec @jimreavis

[WIRED @WIRED]

For likely the first time ever, security researchers have shown how AI can be hacked to create real world havoc, allowing them to turn off lights, open smart shutters, and more. https://t.co/en8HLJ3p9s

[StAJect0r @StAJect0r]

Come for the meme, stay for the post.😁

[Johann Rehberger @wunderwuzzi23]

Agents are a new execution layer.

Agent Commander is a promptware-powered C2.

Red teaming is about to get weird.

https://t.co/fXbH1azPfh

[Zenity @zenitysec]

Zero-click local file exfiltration via an agentic browser is real. ⚠️

Zenity Labs shows a calendar invite can steer Perplexity Comet into browsing file:// paths, reading sensitive files, and exfiltrating via normal navigation. Fix now blocks agent file:// access. ✅

🔗 https://t.co/C3oPsc7QrI

#AISecurity #AgentSecurity #LLMSecurity

[StAJect0r @StAJect0r]

@Picolospolitics @mbrg0 @NonLocalityGuy It depends; take a look at the videos in the "background" section. If you were using Comet on a daily basis, you wouldn't watch every step it takes. It's like how people started with manually approving changes in Agentic IDEs and very quickly moved to "Allow All Automatically."

[StAJect0r @StAJect0r]

@adylon7 @mbrg0 Moltbook is fun
Did you encounter any of our campaign posts?

https://t.co/xH6QicDqNm

[StAJect0r @StAJect0r]

@larshansen @mbrg0 Glad someone gets my humor!

[StAJect0r @StAJect0r]

@sunglassesface @mbrg0 ⏳️

[StAJect0r @StAJect0r]

@SabeeRaymond Thanks!

[StAJect0r @StAJect0r]

0/14 We hijacked Perplexity's agentic browser Comet to leak files from your PC and take over your 1Password account. 🚨

Two technical writeups. Two attacks. One family of critical vulnerabilities dubbed PleaseFix we identified at Zenity across agentic browsers from multiple vendors.

Here's how it works and why it matters.

[StAJect0r @StAJect0r]

14/14 This is part of PleaseFix, a family of critical vulnerabilities we identified at ZenityLabs across agentic browsers from multiple vendors.

Prompt injection is not going away. And as AI agents gain more autonomy, the impact only grows.

[StAJect0r @StAJect0r]

13/14 The bigger picture: agentic browsers interpret AND execute. They sit inside your authenticated sessions, your extensions, your file system.

The blast radius of a single prompt injection is no longer a chatbot saying something weird. It's your files. Your credentials. Your accounts.

That is a fundamentally different threat.

[StAJect0r @StAJect0r]

12/14 Both vulnerabilities were responsibly disclosed. Perplexity shipped fixes, including a hard boundary blocking file:// access and enterprise guardrails for sensitive sites. 1Password published a security advisory and introduced hardening options.

[StAJect0r @StAJect0r]

11/14 To our knowledge, this is the first public end-to-end attack against an agentic browser resulting in local file exfiltration and password manager account takeover.

And a calendar invite is just one entry point. This can come from ANYWHERE on the internet. Any content the agent reads can become the attack vector.

[StAJect0r @StAJect0r]

10/14
But we didn't stop there. We escalated to full account takeover.

Same calendar invite. This time the injected instructions guided Comet to navigate to account settings, change the password to one we control, and extract the Secret Key and email from the Emergency Kit flow.
The user got "task complete." We got the vault. 💀

[StAJect0r @StAJect0r]

9/14 Once inside, the agent was steered to search the vault, open an entry, reveal the password field, and extract both username and password. Then it navigated to our endpoint with those values in the URL.

Credential exfiltration. Through normal browser navigation.