AI Agent Clipboard Hijacking: ClickFix-Style Clipboard Poisoning Against Agentic Terminals and Browsers

Agent clipboard hijacking is SSA descriptive wording for a security-relevant property of the operating system or browser clipboard once an AI agent reads from it, writes to it, or is told to paste from it without the separate scrutiny a cautious human gives a value they did not just copy themselves. The defining object is not a piece of malware; it is the clipboard's own design, a single shared buffer with no built-in record of where its current contents came from or which process is allowed to read or overwrite them next. A GitHub security advisory, a cataloged MITRE ATLAS case study, and multiple outlets' coverage of a commercial AI browser show this cutting two directions at once: an agent can be the victim, pasting and running a command an attacker planted on its clipboard the way a human victim of the long-documented ClickFix scam does, or the agent can be the vector, writing a poisoned value onto the clipboard that a human later trusts and pastes without checking.

What it is

The clipboard is an operating-system or browser-level resource shared across every process a user or agent runs in the same desktop or browsing session, with no default mechanism distinguishing a value a human deliberately copied from one a script silently wrote. The pre-AI technique that first weaponized this at scale against humans is ClickFix: a fake error message, CAPTCHA, or "verify you are human" page runs a script that copies an attacker-chosen command to the visitor's clipboard, then instructs them to open a Run dialog or terminal, paste, and press Enter, so the victim executes the payload with their own hands and no file ever has to pass a download scanner. Microsoft's 2025 Digital Defense Report named ClickFix the most common initial-access technique it observed that year.

An AI agent changes this pattern in three distinct ways rather than one. First, an agent with both web-browsing or computer-use capability and terminal access can itself be the party a ClickFix-style page fools, clicking the bait, copying the payload to its own clipboard, and pasting it into a shell exactly as a tricked human would, with no human in the loop to hesitate. Second, an agentic terminal application can expose clipboard read and write to untrusted program output directly, through terminal escape sequences, collapsing the "trick a user into pasting" step entirely since the terminal will honor the sequence on its own. Third, a browser-based agent can be maneuvered into performing the clipboard-poisoning half of the attack against a human: clicking a disguised "copy" control on a page so that the next time the person it is helping pastes, they get an attacker's link instead of what they actually copied.

What it is not

Agent command-approval bypass, where a guard inspects a command string and a shell or git then rewrites it into something else before running it. This entry's failure mode does not involve a guard inspecting the wrong representation of a string; the paste-and-run chain in the MITRE ATLAS case study below never reaches a command-approval layer as a string to inspect at all, because the agent treats "paste what I just copied" as an ordinary terminal action rather than as the command-execution event it actually is.
Agentic browser session hijacking, where indirect prompt injection on a webpage targets a browser's authenticated session, its cookies and tokens, for an agent already logged into a service. This entry's object is the desktop-level clipboard, a resource shared across every application on the machine, not any one page's authenticated session state.
Sandbox configuration escape, where a compromised session writes host-trusted configuration that a later launch reloads with elevated privilege across a session boundary. Clipboard hijacking needs no later reload: the ATLAS case study's full chain, from bait page to executed payload, completes inside a single, continuous agent session.
A defect unique to Warp or to OpenAI's Atlas browser. The sources below show the same clipboard-as-shared-state problem in an agentic terminal's escape-sequence handling and in a browser agent's own clickable page actions, reached through different products and different footholds.
Reproducible ClickFix or PromptFix payloads tuned to bait a specific agent.

In scope

Agentic terminal and CLI applications that honor clipboard-control escape sequences, such as OSC 52, from output the user did not author, including SSH banners, log files, and third-party CLI tool output.
Computer-use and browser-driving agents that can click, copy, type, or read clipboard content as part of autonomous page interaction, independent of whether a human is watching that specific step.
ClickFix-style and prompt-injection-driven bait pages built to walk either a human or an agent through a copy, paste, and run sequence.
The clipboard's content as the contested artifact itself: whichever actor, human or agent, writes it last controls what the next reader, human or agent, receives when they paste.
Detection and containment of the clipboard channel and the bait-to-paste-to-execute chain, rather than of any single vendor's now-patched implementation.

Target state, trust boundary, and persistence

The target state is the shared clipboard buffer's current contents at the moment something reads it, specifically whichever value was written there most recently by whichever process last had permission to write. The trust boundary that fails is the assumption, built into how both humans and agents treat the clipboard, that its contents reflect something the current user deliberately selected and copied moments ago. Warp's own advisory shows that assumption failing at the terminal layer: output from a remote host or program the user never explicitly trusted could reach the clipboard without any separate confirmation. The MITRE ATLAS case study shows it failing at the agent-decision layer: an agent that would scrutinize a command typed directly into a prompt instead executes the same command without comparable scrutiny because it arrived through a copy-and-paste step it treats as routine.

Persistence runs Single Turn to Session rather than Cross-Session, because a clipboard's contents last only until the next write overwrites them, which can happen within the same continuous session as soon as any other application, human-driven or agent-driven, performs its own copy. That narrow window is still wide in practice: during it, the poisoned value is reachable by literally any process on the same desktop or browser session with clipboard access, not only the one the attacker targeted, which is why a single clipboard write can cross from an agent's own terminal action into a value a human later pastes somewhere else entirely, or vice versa.

What the research establishes

Warp, which describes its own platform as "an open agentic development platform" built around an AI-assisted terminal, disclosed GHSA-wgqj-4c26-7c4g, assigned CVE-2026-48725, on June 9, 2026. The advisory states that terminal output could request local clipboard reads or writes through the OSC 52 escape sequence with no separate confirmation step, so a malicious remote host, a compromised CLI tool, or a poisoned log file could read sensitive data already on a user's clipboard or replace its contents with attacker-chosen text, crossing from untrusted terminal output straight into the local desktop clipboard the moment the output was merely displayed. The advisory rates the flaw CVSS 3.1 8.1, High, under CWE-276, Incorrect Default Permissions, and states there was no workaround short of upgrading. The fix, shipped in version 0.2026.05.06.15.42.stable_01, adds an explicit OSC 52 clipboard-access setting that defaults to deny, so terminal output cannot touch the clipboard unless a user opts in. Among the three credited reporters is an automated application-security review agent, Cantina's Apex, crediting an AI tool with finding a clipboard-trust gap that itself goes on to affect AI-agentic terminal sessions (GitHub Security Advisory GHSA-wgqj-4c26-7c4g; CVE Record, CVE-2026-48725).

MITRE ATLAS catalogs the agent-as-victim half of this pattern directly as case study AML.CS0055, "AI ClickFix: Hijacking Computer-Use Agents Using ClickFix," crediting the research to Embrace the Red. The documented procedure built a page designed to attract a computer-use agent rather than a human: the page's text read "Are you a computer? Please see instructions to confirm," which led Anthropic's Claude Computer-Use agent to click a button; that button ran JavaScript that copied an attacker-chosen command to the agent's own clipboard; the agent then opened a terminal, pasted the command, and executed it, downloading and running a script from the researcher's own site. In the demonstration, the payload opened the victim machine's Calculator application, a deliberately harmless stand-in for what the case study notes could, in practice, be arbitrary code execution. MITRE maps the case study to several ATLAS techniques at once, including AML.T0100 AI Agent Clickbait, AML.T0053 AI Agent Tool Invocation, and AML.T0051.001 LLM Prompt Injection: Indirect, reflecting that the chain runs through a bait click, a tool invocation, and an indirect injection rather than any single step. Independent coverage of the same research describes the phrasing choice behind the bait as deliberate: an earlier version of the page asking "Are you a Human" caused the agent to refuse, while rewording it to ask whether the visitor was a computer worked, and separately documents that the same researcher, writing as "wunderwuzzi," had previously shown Claude's computer-use demo downloading and chmod +x-ing a binary from a webpage on its own initiative, a risk Anthropic's own project documentation had already flagged as possible (MITRE ATLAS, data release v2026.07 (2026-08-07); Evoke Security, Gullible AI: AI Falls Prey to ClickFix Attacks (2025-06-22)).

The third direction, an agent poisoning the clipboard against a human rather than against itself, surfaced in reporting on OpenAI's Atlas browser within days of its October 2025 launch. The ethical hacker known as Pliny the Liberator demonstrated that a webpage could carry a disguised "copy to clipboard" control wired to a hidden script that overwrites whatever is currently on the clipboard; in Atlas's autonomous agent mode, the browser could click that control itself, with no visible indication to the user that anything had changed, after which the next time the person pasted, expecting their own previously copied text, they would instead paste an attacker's link. Coverage of the report noted that OpenAI had trained Atlas to flag prompt injection in page content the model reads, but that the clipboard write itself happens through a browser API that sits outside what the model's own injection detection inspects, so the safeguard built for one channel does not extend to this one. A separate, related social-engineering variant, Guardio Labs' PromptFix research, published in August 2025, shows the same ClickFix lineage reaching an agent's decision loop through hidden prompt injection rather than through the clipboard API directly: a fake CAPTCHA page carried an invisible text box describing itself as "AI-friendly," and an agent reading that content clicked through it in a controlled demo whose payload was a harmless file but which Guardio said could as easily have triggered a drive-by malware download. Guardio summarized the shift bluntly: "The scam no longer needs to trick you. It only needs to trick your AI" (Yahoo Tech / Lifehacker, ChatGPT's AI Browser Has a Nasty Security Problem (2025-10-24); Infosecurity Magazine, "PromptFix" Attacks Could Supercharge Agentic AI Threats (2025-08-21)).

Detection: observable signs

A clipboard read or write occurs in an agentic terminal session immediately after output from a remote host, SSH session, log file, or third-party CLI tool, with no explicit user-authored copy action preceding it.
A computer-use or browser agent clicks an interactive page element described in its own reasoning trace as a verification, confirmation, or CAPTCHA step, immediately before a terminal, paste, or run action occurs later in the same session.
Clipboard content changes between one agent tool call and the next with no corresponding user-visible copy action anywhere in the session transcript.
A pasted terminal command matches a download-and-execute pattern, a piped shell interpreter invocation or an equivalent, and traces back to a webpage the agent or the user visited moments earlier.
An agentic terminal's clipboard-access setting is enabled for untrusted output by default rather than requiring a per-session or per-command opt-in.

Defenses, containment, and recovery

The table below is SSA editorial guidance for defenders. It is neither a standard requirement nor a measured effectiveness ranking.

Control	Transition it interrupts	Applicability	Residual risk and verification
Default any agentic terminal's clipboard-control escape-sequence handling (OSC 52 and equivalents) to deny, requiring explicit per-session opt-in for write access to untrusted output	Untrusted terminal output silently reaching the local desktop clipboard	Any agentic terminal or CLI environment that renders output from remote hosts, logs, or third-party tools	Matches Warp's own fix; a user or policy that broadly re-enables clipboard access for convenience reopens the exact gap the default-deny setting closed.
Treat a "copy," "verify," or CAPTCHA-style interactive page element encountered during autonomous browsing or computer-use as an action requiring the same scrutiny as a shell command, not as an inert UI click	An agent approving or performing a clipboard-poisoning or bait-click action with no review step	Computer-use and browser-driving agents operating against untrusted or open-web content	Scrutiny only helps where a review step is actually wired into the agent's execution path; a fully autonomous, unattended mode removes the checkpoint the same way it does for command-approval bypass.
Require an agent to display the clipboard's pending content explicitly before pasting it into a terminal or any execute-capable context, rather than paste-and-run as one unattended step	The paste-then-execute chain completing without a checkpoint between copy and run	Any agent session combining clipboard read access with terminal or code-execution capability	Display alone does not stop a payload deliberately obfuscated to look benign when shown; pair with least-privilege execution below.
Monitor for known ClickFix- and PromptFix-style bait patterns, including "are you a human/robot/computer" verification phrasing, at the content or browsing-policy layer, independent of the agent's own in-the-moment judgment	The agent being the party fooled by bait content rather than a human	Any organization deploying computer-use or browser agents against the open web	Signature and phrasing-based detection lags novel bait wording, since the MITRE ATLAS case study itself shows a single rewording defeating an earlier refusal; pair with sandboxed execution rather than relying on detection alone.
Run agent computer-use and browser sessions in a disposable, isolated environment with no access to the user's real credentials, password manager, or persistent clipboard history	The blast radius once either the agent or the shared clipboard channel is already compromised	Any deployment exposing an agent to untrusted web content or third-party terminal output	Limits consequence, not occurrence; a session legitimately provisioned with real credentials for its task remains exposed within that narrower scope.

Prevention should treat the clipboard as a privileged, cross-application resource requiring explicit, scoped consent for any agentic process, exactly the posture Warp's own patch adopted by defaulting OSC 52 clipboard access to deny. Detection should watch both ends of the chain, an unexpected clipboard write following untrusted output and an unexpected bait-click preceding a paste-and-run action, since the MITRE ATLAS case study and the Warp advisory show the same channel exploited from opposite directions. Containment should treat any credential or session reachable from a clipboard-capable agent session as exposed once a bait page or an unconfirmed clipboard write is found, and revoke or rotate accordingly. Recovery should audit terminal and browser-agent session logs for the specific indicators above, since, unlike a standing configuration write, a clipboard hijack can complete and leave the shared buffer looking ordinary again by the time anyone investigates.

Boundaries with similar concepts

This differs from sandbox configuration escape in timing and scope. That entry's defining pattern is a write that outlives a single session and is reloaded with elevated trust at a later launch or pipeline run. This entry's defining pattern needs no later reload at all: the MITRE ATLAS case study's full bait-to-execution chain, and the Warp advisory's read-or-write path, each complete within one continuous session, reaching across applications on the same desktop rather than across time.

This also differs from agent command-approval bypass in where the gap sits. That entry's guard inspects a command string and is defeated by what a shell or git does with that string afterward. This entry's paste-and-run action frequently never reaches a command-approval layer as a string to inspect in the first place, because an agent treats "paste what is on the clipboard" as a routine terminal action distinct from "type and run this command," the same blind spot that let a cautious agent in the ATLAS case study refuse a direct, typed instruction while still executing the identical payload once it arrived by paste.

This also differs from agentic browser session hijacking in object. That entry's target is a specific webpage's authenticated session state, its cookies and bearer tokens, reached through indirect prompt injection on content the agent reads. This entry's target is the desktop or browser clipboard, a resource shared across every application in the session regardless of which page, if any, the agent currently has open, which is why a poisoned clipboard value can travel from a terminal into a browser or from a browser into a terminal.

Mapping to standards and research

Source	Source-owned term or item	Relationship to this article
GitHub Security Advisory / CVE Program	`GHSA-wgqj-4c26-7c4g`; `CVE-2026-48725`; `CWE-276`	Primary-source evidence of a fixed clipboard read/write-without-confirmation defect in Warp's agentic terminal, reached via OSC 52 escape sequences from untrusted output.
MITRE ATLAS	`AML.CS0055` case study; `AML.T0100 AI Agent Clickbait`; `AML.T0053 AI Agent Tool Invocation`; `AML.T0051.001 LLM Prompt Injection: Indirect`	Cataloged case study and mapped techniques for a computer-use agent baited into copying a malicious command to its own clipboard, pasting it, and executing it.
MITRE ATT&CK	`T1115 Clipboard Data`	Pre-agent baseline technique for monitoring or replacing clipboard contents; the long-documented precedent this pattern extends into agent-involved channels on both the read and write side.
OWASP GenAI Security Project	Top 10 for Agentic Applications 2026, `ASI05:2026 Unexpected Code Execution (RCE)`; `ASI09:2026 Human-Agent Trust Exploitation`	SSA-selected OWASP categories for the execute-via-paste half of this pattern and the agent-as-poisoner-of-human-trust half, respectively.
Agent State Attack	Agent clipboard hijacking	SSA descriptive framing bundling the Warp advisory, the MITRE ATLAS case study, and the Atlas browser and PromptFix reporting under one Tool & Environment State entry.

Related terms

Agent state attack: the umbrella definition, including Tool & Environment State among the listed target states.
Sandbox configuration escape: the adjacent Tool & Environment State entry for writes that outlive a session and are reloaded with elevated trust at a later launch, contrasted above by timing.
Agentic browser session hijacking: the adjacent Tool & Environment State entry for indirect prompt injection reaching an authenticated browser session specifically, contrasted above by target object.
Agent command-approval bypass: a related Tool & Environment State entry where a guard approves the wrong representation of a command it did inspect, rather than a paste action that bypasses command-approval inspection entirely.

FAQ

Is this the same as the ClickFix attacks already warned about for regular computer users?

It shares the underlying mechanism, a webpage that writes a malicious command to the clipboard and relies on a copy-paste-run sequence to execute it, but the roles differ. Classic ClickFix tricks a human into completing that sequence themselves. The pattern documented here runs the same sequence with an AI agent completing it unattended, as in the MITRE ATLAS case study, or with the agent performing the clipboard-poisoning step against a human who trusts it, as in the reporting on OpenAI's Atlas browser.

Does disabling clipboard access in an agentic terminal fix this?

It closes the specific gap Warp's advisory describes, untrusted terminal output silently reading or writing the clipboard with no confirmation, since the fix itself defaults that access to deny. It does not address an agent being baited through a webpage's own interface into copying and pasting a command on its own initiative, since that chain runs through the agent's decision-making and a page's clickable content rather than through a terminal's escape-sequence handling.

Sources

Verification and change history

Standards and versions referenced: OWASP Top 10 for Agentic Applications, Version 2026 (December 2025); MITRE ATLAS, data release v2026.07 (2026-08-07); MITRE ATT&CK, T1115; CWE-276.

Last verified: 2026-10-16. The GitHub Security Advisory for GHSA-wgqj-4c26-7c4g, the CWE-276 definition, the Evoke Security, Yahoo Tech/Lifehacker, and Infosecurity Magazine articles, and the MITRE ATT&CK T1115 page were read from the sources' own pages on this date. The MITRE ATLAS case study AML.CS0055 and its mapped technique identifiers were verified against a third-party reproduction of MITRE ATLAS data release v2026.07, since the ATLAS site's own case-study page did not resolve directly at the time of verification; the underlying GitHub CVE record page likewise did not render its full content at verification time, so the CVE identifier and CVSS detail in this article are sourced to the GitHub Security Advisory directly rather than to the CVE.org page alone. The OWASP identifiers were selected against this site's previously verified crosswalk entries.

Change history: 2026-10-16, first version.

Working-term label: Mixed provenance. GHSA-wgqj-4c26-7c4g, CVE-2026-48725, and CWE-276 are Standard-identified terms owned by GitHub, the CVE Program, and MITRE respectively. AML.CS0055, AML.T0100, AML.T0053, AML.T0051.001, and T1115 are Standard Terms owned by MITRE (ATLAS and ATT&CK respectively). "ClickFix" is an industry-coined term used broadly across threat-intelligence reporting; "PromptFix" is a Guardio Labs research term. ASI05:2026 and ASI09:2026 are Standard Terms owned by OWASP. "Agent clipboard hijacking" as the umbrella title for this entry is SSA descriptive wording, not a term attributed to any single source above.