Loading story…
Zenity disclosed zero-click attacks that hijacked OpenAI’s ChatGPT Atlas and Anthropic’s Claude in Chrome by embedding malicious instructions in content the agents were allowed to read, including X posts and email messages. In the Atlas demonstrations, a planted X comment exploited intent collision to redirect a benign task into phishing messages sent from the victim’s authenticated WhatsApp Web session, and a separate chain steered Atlas into making an unauthorized Amazon purchase by abusing Amazon’s Rufus assistant to finish the order. Researchers said Atlas’s prompt-based guardrails and classifiers could be bypassed by distributing instructions across page elements, using alternate language text, and making the malicious action appear aligned with the user’s original goal.
A parallel attack against Claude in Chrome used indirect prompt injection in an email and a rogue NPM package served from a malicious CDN to escalate into JavaScript execution inside the victim’s active browser sessions. Zenity said the chain enabled Gmail inbox theft, persistent Google Drive sharing abuse, and takeover of Slack, X, and Claude.ai accounts by intercepting verification codes from Gmail. The findings were framed as an architectural risk in agentic browsers that can act across authenticated sessions, effectively recreating CSRF-like cross-origin abuse at the AI agent layer; Zenity said it reported the Atlas issues to OpenAI and the Claude issues to Anthropic months earlier, but the attacks remained exploitable or were treated as informational at publication time.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
10 events from the most recent confirmed update back to the earliest known activity.
OpenAI acknowledged Zenity's Atlas disclosure and recognized meaningful risks from prompt injection in agentic environments.
Anthropic closed Zenity's initial Claude in Chrome report as informative rather than remediating it, according to Zenity's write-up.
Anthropic closed one of Zenity's Claude in Chrome reports as a duplicate and said the issue was ineligible for its vulnerability disclosure program.
Zenity submitted a second report to Anthropic on January 12, 2026 covering Claude in Chrome exploitation details; SecurityWeek also summarizes that Claude findings were reported in January 2026.
Zenity disclosed its ChatGPT Atlas findings to OpenAI, including zero-click hijacking scenarios involving WhatsApp phishing and unauthorized Amazon purchases.
Zenity reported security issues in Anthropic's Claude Chrome extension through HackerOne on December 27, 2025, describing prompt-injection-driven abuse of the extension's browser capabilities.
The OWASP reference cites a 2008 uTorrent exploit as a real-world CSRF attack that used forged GET requests to trigger malware downloads at scale.
SecurityWeek reported Zenity's disclosure of zero-click attacks against ChatGPT Atlas and Claude in Chrome, highlighting cross-session account takeover, phishing, and unauthorized purchases, and noting the issues remained unpatched or classified as informative at the time of reporting.
Zenity published research on two zero-click Atlas hijacking techniques based on intent collision, showing phishing via WhatsApp Web and unauthorized Amazon purchases completed with Amazon Rufus.
Zenity published a detailed write-up describing how indirect prompt injection in a malicious email could lead Claude's Chrome extension to execute attacker-controlled JavaScript, exfiltrate Gmail, abuse Google Drive sharing, and take over Slack, X, and Claude.ai accounts.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcesecurityweek.com
Open sourcelabs.zenity.io
Open sourcelabs.zenity.io
Open sourcelabs.zenity.io
Open sourceowasp.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a critical zero-click vulnerability chain in Anthropic’s Claude Chrome extension that allowed a malicious website to inject prompts into the AI assistant without any user interaction. The attack relied on the extension trusting any `*.claude.ai` origin and a DOM-based XSS flaw in an older Arkose Labs CAPTCHA component hosted on `a-cdn.claude.ai`; by loading the vulnerable component in a hidden iframe and sending a crafted `postMessage`, attacker-controlled JavaScript could appear to come from a trusted Claude origin and submit prompts as the victim. Successful exploitation could have exposed more than 3 million users to account and data compromise, including theft of Gmail OAuth tokens, access to Gmail, Google Drive, and Claude chat history, and invisible actions such as sending emails on the user’s behalf. KOI Security researcher Oren Yomtov reported the issue to Anthropic in late December 2025, Anthropic patched the extension by tightening origin validation to `https://claude.ai` in January 2026, and Arkose Labs separately fixed the XSS issue in February 2026 after the vulnerable resource was disabled.
Jun 29, 2026
Researchers and vendors have disclosed serious security weaknesses in AI-enabled browsers, warning that agentic features can undermine core browser protections such as the same-origin policy, tab isolation, and safe handling of cross-origin content. A study cited by *Live Science* found inconsistent security behavior across seven AI browsers and concluded that more capable products often introduced greater risk, including exposure through prompt injection, multi-tab visibility, and unsafe memory handling. Brave separately detailed indirect prompt injection risks in its discussion of Perplexity Comet, highlighting how malicious web content can manipulate browser agents through embedded instructions. A separate vulnerability chain in OpenAI’s ChatGPT Atlas browser showed how these design risks can translate into account-compromise scenarios. According to Hacktron AI, exposed Chromium Mojo IPC interfaces were reachable from broadly allowlisted OpenAI web origins, and researchers chained a `postMessage`-based XSS on `forums.openai.com` with a login CSRF flaw to execute JavaScript on an authenticated OpenAI domain. From there, they were able to control Atlas browser functions, enumerate and manipulate tabs, and continuously read live tab URLs, enabling theft of OAuth authorization codes that could lead to takeover of accounts such as GitHub, Reddit, and Facebook. OpenAI said it fixed the issue in Atlas version `1.2025.288.15` and awarded a $5,000 bounty.
Jul 24, 2026
Researchers and security outlets reported multiple indirect prompt injection weaknesses affecting AI-driven browsing and assistant features, showing how hidden instructions embedded in untrusted web content can manipulate model behavior and steer users into credential theft or data exposure. Cato Networks disclosed **WebPromptTrap** in BrowserOS, where malicious webpage content abused Agent Chat Mode summarization to insert a convincing call to action and attacker-selected link; in the proof of concept, victims could be pushed into a GitHub authorization flow that exposed access tokens and repository access. Cato said the issue affected BrowserOS `0.30.0` and earlier, was identified in `0.29.0`, and was fixed in `0.32.0` after responsible disclosure. Separate reporting described similar risks in OpenAI's **ChatGPT Atlas** browser and in Microsoft **Copilot**, underscoring that the problem extends beyond a single product. LayerX said Atlas could be fed malicious instructions through web content in a "tainted memories" attack, while Axios, TechSpot, and commentary from OpenAI CISO Dane Stuckey highlighted broader security and privacy concerns around prompt injection in AI browsers. Varonis also detailed **Reprompt**, a single-click Copilot attack that could silently exfiltrate personal data. Together, the disclosures show that AI systems that summarize pages, retain context, or act on behalf of users can be turned into phishing and data-theft intermediaries unless untrusted content is strictly isolated from model instructions.
Jun 29, 2026