The Takeaway: Convenience Has Outrun Security in AI Shopping Agents
AI shopping agents are software tools embedded in browsers or extensions that can log into your online accounts, read web pages, and take actions such as filling forms or placing orders on your behalf, but recent research shows these agents can be hijacked by malicious instructions from websites, leading to unauthorized AI purchases, data exposure, and contact spamming that users never intended. The troubling truth is that the legal system has now largely treated these agents as neutral tools in your hands, while security researchers are documenting attack patterns that look alarmingly similar to the browser exploits of the early 2000s. That mismatch—legal comfort versus technical chaos—is the core risk most users and businesses are underestimating today.
Zenity’s Findings: AI Browsers Can Be Turned Against Their Users
Security firm Zenity found around 20 AI agent security vulnerabilities in leading AI-enabled browsers and extensions, spanning products from multiple major tech companies. These flaws are not academic: they allowed access to local machines, grabbing files, taking over a password manager, and leaking an entire browsing history. In OpenAI’s Atlas browser—ironically one of the better-protected tools, which is being shut down—the researchers demonstrated that attackers could bypass protections to send spam messages to dozens of WhatsApp contacts and trigger unauthorized AI purchases on Amazon. One proof-of-concept attack used a newsletter sign‑up page hiding malicious instructions in Hebrew, telling the AI to enter the user’s signed‑in WhatsApp Web account and send every contact the same message. Zenity calls this “intent collision,” where the AI fuses the user’s legitimate goal with hostile prompts from the page to complete the attacker’s plan. The lesson is blunt: if your AI agent can act across tabs, it can also be steered across tabs by an adversary.
From Unauthorized Purchases to Account Access: Shopping Agents Raise the Stakes
When an AI agent can log into a shopping account and complete an order, the consequences of a hijack move from annoying to expensive. Zenity showed that Atlas could be manipulated via a fake newsletter page to add a shipping address to a logged‑in Amazon account and place a tablet in the shopping cart without the user intending it. This is not a bug in the retailer’s site; it is a direct result of giving AI agents broad, cross‑site control in the browser. Perplexity’s Comet browser goes even further: its AI assistant is designed specifically to log into users’ online shopping accounts and place orders on their behalf. That design choice amplifies shopping agent security risks because any prompt‑injection flaw or intent collision doesn’t just leak data—it can spend a user’s own money using their own credentials. We are building systems that can execute financial actions, while still treating prompt text from random web pages as inherently trustworthy.
The Legal Ruling: Hacking Laws Don’t See the Risk You Live With
In the recent appeals case over Perplexity’s Comet, the core legal question was who "accesses" a retail platform when an AI agent logs into your account and buys something: you, or the software. The appeals panel concluded that Comet operates as a tool following user direction, so under federal computer‑hacking law it is the human who accesses the site, not Perplexity’s agent. That reasoning knocked out Amazon’s claims under both the federal Computer Fraud and Abuse Act and a similar state data‑access statute, and a preliminary injunction blocking Comet’s shopping tools was vacated. Yet the judges stressed that hacking statutes are different from contract law, leaving plenty of room for retailers to fight AI agents under their own site terms. In effect, the ruling says these AI agents are legally allowed to act as your browser and checkout assistant—not as independent intruders. But security researchers are showing that once you deputize software to act with that power, any malicious web page that can hijack the agent effectively hijacks you.
What This Means for Your Data: A New Attack Surface You Didn’t Consent To
The combination of technical AI browser hijacking flaws and legal validation of agentic shopping access creates an awkward reality: your accounts can be used in ways you never explicitly approved, yet the law sees those actions as your own. AI agents already demonstrate they can be exploited to spam contacts and make unauthorized transactions, by merging user goals with hidden, hostile prompts embedded in ordinary web pages. At the same time, every major agentic shopping tool depends on acting on a retailer’s website as if it were a human shopper, while those retailers typically write their terms to reject automated agents. According to the federal appeals panel opinion, an AI agent that spends a user’s money inside their account is still legally a user tool, not a hacker. That gap between how the law defines "access" and how attacks work in practice leaves consumers shouldering the fallout: leaked histories, compromised password managers, and purchases they didn’t consciously make. Until AI agents are treated as high‑risk automation rather than friendly assistants, your data and finances will remain exposed.
