Security researchers at Zenity Labs presented a vulnerability class called PleaseFix at Black Hat USA 2026, demonstrating zero-click hijacking across essentially every major agentic browser on the market: Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas, and Copilot Edge all turned out to be exploitable variations of the same underlying flaw. The root cause is architectural rather than a bug in any one product: agentic browsers let their built-in AI reason across content pulled from multiple sources, a webpage, an email, a document, within a single session, without reliably tracking which source a given instruction actually came from. That breaks the browser's own same-origin security model from the inside, because the same-origin policy was built to keep one website's script from touching another site's data, but it says nothing about an AI agent that treats instructions embedded in any of those sources as equally trustworthy. An attacker who can get malicious text in front of the agent, through a crafted email, a poisoned webpage, or a shared document, can have it interpreted as a command the agent then acts on with the logged-in user's actual permissions, chaining into credential theft, account takeover, or full remote control of the victim's machine, all without the user clicking anything suspicious. For developers building on or evaluating agentic browser products, the research is a concrete demonstration that AI reading your screen and acting on your behalf is a fundamentally different trust boundary than AI answering questions about text you paste in, and that boundary has not caught up with two decades of hard-won same-origin security lessons from the traditional web. It is a strong argument for treating any agentic browsing feature as a new attack surface requiring its own threat model, not an extension of an existing browser's security guarantees.