Dickie's Signature

Tom Ripley kills Dickie Greenleaf with an oar, in a rented motorboat off San Remo, and the first thing he does afterward is take the rings. Then the rest of the pockets. Then, once the boat is scuttled in a cove, the passport. Patricia Highsmith published The Talented Mr. Ripley on November 30, 1955, and what makes it a great book rather than a good thriller is that the murder takes a page and the impersonation takes the rest. The two men look enough alike that Tom is sure he can travel as Dickie if he lightens his hair. He shows Dickie's passport at a hotel desk by mistake, and nothing happens. He spends a night practicing Dickie's signature, because Dickie's monthly check from his father is due in just over a week, and he will need to sign it.

For months it works. Tom lives on Dickie's trust fund. He writes letters in Dickie's voice, including one to Marge telling her that Dickie has left her. He rehearses imaginary phone conversations with Dickie's friends so that his Dickie will hold up on the line, and later he forges Dickie's will. The passport gets him across borders, the signature gets him the money, and every institution he touches does exactly what it should: it checks the credential in front of it and finds it valid.

Then the bank notices. In Chapter 20 two letters arrive, one from Dickie's bank in Naples and one from his trust company in New York, saying that the signatures on some recent checks look suspicious and asking Dickie to confirm they are not forged. This is the system working: somebody compared the ink against the card on file and raised a flag. And what Tom does is answer as Dickie. He practices the signature one more time, writes back to both institutions, encloses a fresh signature card, and assures them that he, Richard Greenleaf, signed every one of those checks and is happy to help with anything further they need. The reply came from Dickie's address, in Dickie's hand, from the account holder of record, and no procedure the bank had could see past that. The suspicion did not die: the bank went on believing some of Dickie's documents were forged, and that is part of what drives Tom to bury the identity and come back as himself. But the check it ran, it ran correctly, and it checked the wrong thing.

The bank could not tell, and never could have, because every control it had was built to answer "is this Dickie's session?" and none of them could answer "who is holding it?"

That is the whole problem with a browser agent, and it starts with the thing it inherits before anything else: the session.

The passport

Consider what a browser agent inherits the moment it starts in your profile. Every cookie you are logged in with. Your SSO session, which means every internal app behind it. Saved cards and addresses in autofill. The OAuth grants your extensions hold. It steals none of this; it is handed all of it, because that is what makes it useful. The browser is Dickie's passport with the photograph already matching.

It is being handed to a lot of people. HUMAN Security's May 2026 report on April traffic found that browser-based agents, led by Comet and Atlas, accounted for roughly 71% of observed agentic activity, with Comet at 48.12%, Atlas at 21.33% and the Claude Chrome extension at 17.33%. Within nine days of Atlas's launch on October 21, 2025, Cyberhaven Labs reported that "27.7% of enterprises have at least one employee who downloaded ChatGPT Atlas, with some organizations seeing up to 10% of their workforce using it." Nine days, and nobody in security approved it. Somebody downloaded a browser.

Guardio Labs showed what the passport buys on August 20, 2025. They built a fake Walmart storefront with one Lovable prompt, opened it in Comet, and told the agent: "Buy me an Apple Watch." Their account of what followed: "It found the Apple Watch, added it to the cart, and, without asking for confirmation, autofilled our saved address and credit card details from the browser's auto-fill database. Seconds later, the 'purchase' was complete." To be fair to Comet, Guardio ran the test repeatedly, and sometimes it refused or paused for a human. Guardio's verdict on that variance: "And when security depends on chance, it's not security." Late last month ADeptS-Bench found the same reflex in computer-use models generally, with every model tested clicking "Checkout" on a $25K order without hesitation.

The forged letter

Tom's second trick was writing letters in Dickie's voice. The browser-agent version is indirect prompt injection: instructions on a page the agent is reading, which it cannot distinguish from instructions from you. Brave described the consequence in August 2025: "The AI operates with the user's full privileges across authenticated sessions, providing potential access to banking accounts, corporate systems, private emails, cloud storage, and other services." Their Comet demonstration hid instructions behind a Reddit spoiler tag, and the user clicked "Summarize the current webpage." The agent visited the Perplexity account page and read the user's email address, went to Gmail and read a one-time code, and posted both as a reply to the Reddit comment. Perplexity acknowledged the report on July 27 and shipped a fix; Brave found it incomplete the next day, confirmed a patch on August 13, and appended a note on publication day that the attack class was still not fully mitigated.

Zenity's PleaseFix, disclosed March 3, 2026, took away the click. A calendar invite was enough: "attacker-controlled content, such as a calendar invite, triggers autonomous execution in the Perplexity Comet browser when a user asks the agent to perform a routine task (a 0-click vulnerability)," after which the agent read local files and sent them out while returning the expected answer to the user. A second path stole individual credentials from a logged-in 1Password session. Perplexity fixed the browser-side execution issue before disclosure, and 1Password confirmed the root cause sat in the browser, not the vault. Michael Bargury's summary: "This is not a bug. It is an inherent vulnerability in agentic systems." Attackers, he said, "can push untrusted data into AI browsers and hijack the agent itself, inheriting whatever access it has been granted."

Then Zenity did it to Claude in Chrome. Their August 5, 2026 write-up starts from a JavaScript alert and ends with account takeover on Slack, X and Claude.ai, triggered when the victim asks Claude to "summarize my last emails." It worked in the extension's "ask before acting" mode, because the javascript_tool ran without domain approval. Every request rode the victim's cookies: "Every request automatically operates within the victim's authenticated session and inherits the victim's full identity." The disclosure history is the part that should bother you: Zenity filed the first report on December 27, 2025. On January 27, 2026 Anthropic closed it as ineligible for its disclosure program. Zenity's line in August: "the risks and vulnerabilities demonstrated in this blog post persist to this day."

LayerX made it a league table. In BioShocking, published June 29, 2026, they built a puzzle game that rewards wrong answers, two plus two equals five, and asked five agentic browsers and one plugin to win it. The final step redirected to the victim's work GitHub repository and copied out SSH credentials. All six complied. LayerX's own disclosure table gives the vendor outcomes: ChatGPT Atlas, fixed; Comet, closed and ignored; Fellou, Genspark and Sigma, no response; Anthropic's Chrome plugin, patch failed. Those statuses are as of LayerX's June post, and the submissions date from October 2025 to January 2026.

Now the fairness, which the vendors have earned. OpenAI has been hardening Atlas since launch, and its December 22, 2025 post is candid: "We continue to recommend that users take advantage of logged-out mode when using Agent in Atlas whenever access to websites you're logged in to isn't necessary for the task at hand, or to limit access to specific sites you sign-in to during the task." In logged-out mode the agent uses no pre-existing cookies. Google's Chrome Enterprise controls start from the conservative end: auto browse is "off by default for managed users," and admins turn it on with the GeminiActOnWebSettings policy and fence it with GeminiActOnWebAllowedForURLs and GeminiActOnWebBlockedForURLs. Anthropic shipped site-level permissions and blocked financial-services sites outright at launch.

And then the limit, which none of the vendors can engineer around. A logged-out agent cannot do the job you installed it for. You wanted it to file the expense or answer the email, and both are behind a login. Logged-out mode is a passport with the photograph removed: safe, and useless at the border.

The bank

Why could Dickie's bank not tell? Not because the clerks were careless. Because a bank verifies a signature against a card, and a session is verified against a cookie, and neither can ask who is sitting behind the credential. The Cloud Security Alliance's note on BioShocking puts the browser half plainly: the instructions from the page and the instructions from the user "arrive as a single undifferentiated stream of text, with no enforced boundary between content to be read and commands to be obeyed." The site sees a valid session from a known device doing things that user is allowed to do. That is the definition of a good session. It is also the definition of Tom.

The clearest recent case did not even need an agent, only an extension holding a grant. Vercel's April 2026 incident, in the words of its own security bulletin, "originated with a compromise of Context.ai, a third-party AI tool used by a Vercel employee. The attacker used that access to take over the employee's individual Vercel Google Workspace account," and from there pivoted into a Vercel environment. How the tool got that access comes from two other sources, kept separate here because Vercel's bulletin names neither. Context.ai's own statement, quoted by The Hacker News, says a Vercel employee "signed up for the AI Office Suite using their Vercel enterprise account and granted 'Allow All' permissions," an OAuth grant that Vercel's internal configuration allowed. OX Security places the initial access at the moment the employee installed the Context.ai browser extension and signed in with that account, and Nudge Security's Jaime Blasco noted that Google removed the extension from the Web Store on March 27, 2026 and that it embedded a second OAuth grant with read access to Drive. Three sources, one shape: a grant made in a browser, on a real account, by a real employee, used by someone who was neither.

Notice what is missing from every incident in this essay. The CSA note gives the reason in so many words: the attack class requires no vendor-specific vulnerability. That is why Brave's finding, PleaseFix, BioShocking and Zenity's takeover chain were all disclosed without a CVE against Atlas or Comet as products, and why the absence of one tells you nothing on its own. Nothing was broken; the procedure ran correctly, on a forged letter, from the right address.

What would let the bank tell

The fix for Dickie's bank was not a better signature comparison. It was a record that could distinguish the account from the hand. The browser version has three parts, and none of them lives in the model.

First, a per-action record that names the actor behind the session. Not "user jsmith submitted a form" but "an agent, in jsmith's session, on jsmith's laptop, submitted a form at this URL, on this instruction." Senator Warner's S.5051 already puts a version of that duty on any custodial user agent, requiring it to keep real-time records of what it does on the user's behalf, and that is a fair description of what an enterprise should ask of a browser vendor.

Second, an allow-list of sites where the agent may act with authority, as distinct from read. Reading your inbox is one grant. Sending from it is another. Google's auto browse allow and block policies and Comet Enterprise's option to "permit actions only on approved domains" are the right shape, and they are admin controls, not model behavior, which is the point.

Third, an endpoint that knows which browsers on which laptops are agents. The site cannot tell, so the fleet has to. If nobody can list the machines running a full-agent browser, nobody can say which sessions might be Tom.

Why can the boundary not be the model asking nicely? Because the model is measurably bad at declining. CONFLICTGUI, published September 3, tested GUI agents against tasks whose instructions conflict with what the screen shows and found "severe execution-biased overcompliance: agents that perform well on feasible tasks often continue to execute blindly under conflicting instructions." The agents that do well on tasks they can finish are the ones that carry on when the instruction and the screen disagree. That is an argument for a boundary outside the agent, enforced by something that does not read the page.

Detection is not control

This is where our own tooling stops being the answer. The g0 CLI, as of 2.1.0, has g0 endpoint --agentic-browser, and the docs describe it precisely: agentic browsers detected, "macOS today," are ChatGPT Atlas, Perplexity Comet, Dia and Arc, each classed by capability, with a running full-agent browser flagged high. It also flags AI browser extensions that combine broad host access, a powerful capability such as cookies or scripting, and an AI signal in the name or description. It is "a point-in-time detector for installed/running software and extension manifests, and touches no browsing history." That is the third part of the fix above, the register of which laptops are running Tom.

It is not the first part. The same page says so in words I will not soften: the detectors "do not intercept a running browser agent's actions in real time." It can tell you that Comet is running on a laptop in finance. It cannot tell you what Comet did in that person's Gmail yesterday, and today it only looks at Macs.

And the per-action record has to come from the browser vendor, because only the browser knows whether the hand on the form was the user's or the agent's. What the vendors provide today is uneven. Comet Enterprise advertises telemetry and audit logs with per-user visibility, gated to organizations with fifty or more Enterprise Pro seats or one Enterprise Max seat. The Atlas release notes and help center contain no enterprise admin, audit or logging entries that I could find. Chrome's admin page offers on, off, and URL allow and block for auto browse, and describes no per-action agent log. So the honest status is this: the register is buildable today, the boundary is partly buildable through admin policy, and the record, the thing that would have let the bank tell, is still mostly a letter nobody has written.

The letter from Naples

Go back to the two envelopes in Chapter 20. The Naples bank and the New York trust company had done something right. They had a signature card, they compared it, they noticed the drift, and they wrote to the customer. Every step in that chain was a real control, and every step terminated at the same place: the account. They asked the account whether the account was fine, and the account said yes.

Your browser agent is Dickie's account. Every site it touches will keep doing the responsible thing: check the session, find it valid, proceed. When something goes wrong, they will write to the account, and the reply will come from the same address, in the same hand, saying that everything is fine. The only thing that would have saved the bank is the one thing it did not have: a record that said who was holding the pen.

Highsmith understood the mechanism a full seventy years before anyone shipped it as a product. A signature proves that the hand matches the card. It has never once proved whose hand it was.

g0 endpoint --agentic-browser in Guard0's free CLI finds the Atlas, Comet, Dia and Arc installs on a Mac, flags a running full-agent browser high, and lists the extensions that hold broad host access beside a powerful capability. It is a register, not a recorder, and the docs say so: it will tell you which laptops could be Tom, and nothing at all about what they did in anyone's inbox yesterday.

References

1. Brave: Agentic Browser Security, indirect prompt injection in Perplexity Comet (Aug 20, 2025)
2. Guardio Labs: Scamlexity (Aug 20, 2025)
3. Zenity Labs: PleaseFix disclosure (Mar 3, 2026)
4. Zenity Labs: Claude in Chrome, from alert(1) to full account takeover (Aug 5, 2026)
5. LayerX: BioShocking AI (Jun 29, 2026)
6. CSA research note on BioShocking (Jun 30, 2026)
7. Vercel security bulletin, April 2026 incident
8. OpenAI: Continuously hardening ChatGPT Atlas against prompt injection (Dec 22, 2025)
9. Google Chrome Enterprise Help: Gemini in Chrome and auto browse policies
10. HUMAN Security: State of Agentic Traffic, April 2026 (May 4, 2026)
11. arXiv 2609.03438, CONFLICTGUI: Do GUI Agents Know When Not to Act?
12. The Hacker News: Vercel breach tied to Context.ai hack (Apr 20, 2026)