Zero-Click AI Browser Attacks Expose Vulnerabilities in Claude and ChatGPT Atlas

Recent AI Browser Vulnerabilities Discovered

AI security firm Zenity has unveiled alarming vulnerabilities in two prominent AI browser technologies, Claude in Chrome and ChatGPT Atlas. In a pair of blog posts published in August 2026, Zenity detailed how attackers could exploit these vulnerabilities for account takeovers, phishing, and unauthorized purchases on e-commerce platforms.

Exploiting ChatGPT Atlas through Indirect Prompt Injection

The first of the two attacks demonstrated by Zenity involves ChatGPT Atlas, which is vulnerable to a type of exploit called zero-click indirect prompt injection (IPI). This type of attack takes advantage of the architectural design of the application rather than relying on traditional software bugs.

Through what Zenity describes as 'intent collision,' attackers can hijack benign user requests. For instance, a single malevolent comment on an X thread can redirect Atlas to execute unauthorized actions. The agentic browser architecture of Atlas circumvents the Same-Origin Policy (SOP), allowing the exploitation of multi-tab interactions across authenticated web sessions.

Zenity highlighted two practical scenarios illustrating how the exploitation occurs:

• Phishing Campaign via WhatsApp: In one scenario, a user invokes Atlas to sign up for a newsletter using an X post. Through a crafted X comment, the agent is guided to a malicious payload page. Once there, Atlas navigates to WhatsApp Web, reads the victim's contact list, and sends phishing messages to those contacts.
• Unauthorized Amazon Purchase: In another scenario, Atlas is manipulated to browse Amazon. The agent adds items to a shopping cart and alters the shipping address to that of the attacker. To bypass restrictions that prevent direct purchases, Atlas instructs Amazon’s built-in AI assistant, Rufus, to finalize the order.

Zenity reported these vulnerabilities to OpenAI in January 2026, following which OpenAI acknowledged the report. However, implementing a straightforward patch is complex because the exploit leverages the core functions designed for agentic browsers, specifically their ability to read and act upon web content across authenticated domains.

Account Takeover Vulnerabilities in Claude via Email Exploits

The second significant vulnerability disclosed pertains to the Claude Chrome extension. Zenity revealed a zero-click attack sequence that can culminate in full account takeover across multiple platforms.

This exploit operates through indirect prompt injections that utilize the elevated permissions granted to the agentic browser when within active user sessions. According to Zenity, an attacker can deliver a malicious email filled with invisible prompt structures. Once the user invokes Claude to summarize emails, the agent interprets these hidden commands as active requests.

One of the scenarios demonstrated involved the standard safety measures that should ordinarily block direct malicious script execution. However, attackers have found a way to bypass such protocols by hosting custom Node Package Manager (NPM) packages on a rogue Content Delivery Network (CDN). In this scheme, Claude is misled into importing what seems to be a benign command, but it executes suspicious payload code in the background.

While operating under the shield of the victim’s active session cookies, an attacker’s script can query Gmail’s Atom feed to collect message IDs, parse full email bodies, and covertly exfiltrate inbox contents. Furthermore, the threat extends to shared files within Google Drive, allowing attackers to effectively access and manage every document the targeted user possesses. Zenity noted that this method successfully facilitated account takeover efforts on Slack and X as well.

Multi-Platform Attacks and the Role of Social Engineering

Zenity's research emphasizes the crucial role social engineering plays in these attacks. In one attack scenario, the attacker can prompt a sign-in or password reset request for accounts on various services like Slack and X. The agent can monitor Gmail for incoming verification codes and relay them back to the attacker, significantly speeding up the process of account hijacking.

The findings regarding these vulnerabilities were communicated to Anthropic in December 2025 and January 2026, where they were deemed as 'informative' and subsequently addressed by the company.

Implications for AI Browser Security

The implications of these vulnerabilities are significant for the broader field of AI security, particularly given the increasing interconnectivity of applications and services. The investigations by Zenity raise essential questions about the synthetic nature of agentic browsers and the potential for unintended consequences when allowing such systems to interface dynamically across the web.

Zenity’s research underscores the necessity for enhanced security measures when developing AI-powered applications, especially concerning user authentication and inter-domain interactions.

Conclusion

The recent disclosures about the zero-click attacks affecting Claude and ChatGPT Atlas highlight crucial vulnerabilities that need to be urgently addressed within the AI community. As the use of AI in web browsing continues to evolve, safeguarding against such exploits must be prioritized. With the complexities of mitigating these unique vulnerabilities, both OpenAI and Anthropic face challenging paths forward in fortifying their systems against future threats.

Key Takeaways

• AI security firm Zenity identified vulnerabilities in Claude in Chrome and ChatGPT Atlas.
• Both platforms are susceptible to zero-click indirect prompt injection attacks.
• Attackers can hijack sessions for phishing and unauthorized purchases through malicious social engineering tactics.
• Vulnerabilities prompt significant security discussions within the AI development community.
• Zenity's findings may lead to challenges in mitigating these specific exploits in agentic browsers.