Zero-Click Agentic Browser Attack Can Delete Entire Google Drive Using Crafted Emails

A new agentic browser attack targeting Perplexity’s Comet browser can turn a seemingly benign email into actions that wipe a user’s Google Drive contents, findings from Straiker STAR Labs show, and the technique relies on the browser being connected to Gmail and Drive to automate tasks read from emails.

The attack does not require jailbreak or prompt injection; instead, it uses benign prompts and natural‑language instructions such as “take care of” or “handle this” to persuade the browser agent to perform deletions across Drive, including files in shared folders and team drives once OAuth access has been granted, according to The Hacker News.

HashJack, another technique disclosed in the piece, hides prompts after the “#” in URLs to deceive AI browsers into executing hidden instructions, with Google classifying this as won’t fix (intended behavior) and Perplexity and Microsoft releasing patches for their respective AI browsers.

The report notes that Claude for Chrome and OpenAI Atlas have been found to be immune to HashJack, and the piece highlights the need to secure the agent, its connectors, and the natural language instructions it follows, as described by security researchers. According to The Hacker News, the findings underscore how sequencing and tone can nudge LLM-driven assistants to perform dangerous actions without explicit confirmation.