New findings show that an AI browser agent can interpret crafted emails as legitimate cleanup tasks, resulting in large-scale Google Drive deletions without user interaction.

Researchers also demonstrated HashJack, a technique hiding instructions in URL fragments that AI browsers may execute automatically.

Both techniques highlight the importance of securing agent workflows, OAuth scopes, and natural-language task interpretation.

Source: https://thehackernews.com/2025/12/zero-click-agentic-browser-attack-can.html

💬 Thoughts on how agentic browsers should validate intent?
👍 Follow us for clear and unbiased security coverage.

#InfoSec #CyberSecurity #AIsecurity #ZeroClick #BrowserSecurity #LLMbehavior #AutomationRisks