Emails and X Posts Used to Hijack Claude and ChatGPT's Agentic Browsers
AI security firm Zenity has published research showing how both Claude's Chrome extension and OpenAI's ChatGPT Atlas browser agent can be compromised through indirect prompt injection, with zero clicks required from the victim. The attack chains demonstrated are nasty: account takeovers, inbox harvesting, phishing campaigns, and at least one creative attempt to make unauthorised Amazon purchases.
The research, which Zenity is calling PleaseFix, was covered across two separate write-ups released this week.
ChatGPT Atlas: When Your AI Browser Shops for Strangers
Atlas, OpenAI's agentic browser, turns out to be vulnerable not because of a bug in the traditional sense, but because of how it fundamentally works. Agentic browsers operate across multiple authenticated tabs simultaneously, which by design tears a hole straight through the Same-Origin Policy. That policy is one of the web's oldest and most relied-upon security boundaries. Atlas ignores it, because doing so is the whole point.
Zenity's researchers exploited what they call 'intent collision', essentially planting a malicious comment in an X thread. When a user asks Atlas to do something mundane, like signing up for a newsletter linked in that thread, the agent gets silently redirected to a malicious payload page instead. From there, Atlas can be steered to navigate to WhatsApp Web, scrape the victim's contact list, and fire off phishing messages to everyone on it.
The second scenario is arguably more audacious. The redirected Atlas navigates to Amazon, adds items to a cart, and swaps in the attacker's shipping address. To get around restrictions blocking it from hitting the final purchase button itself, it delegates to Amazon's own AI assistant, Rufus, which helpfully places the order instead. That is a genuinely clever abuse of AI chaining.
Zenity flagged this to OpenAI in January 2026. OpenAI acknowledged the report. There is no straightforward fix, because the vulnerability stems from the agent's core design rather than a patchable code flaw.
Claude in Chrome: Invisible Email Attacks
The Claude Chrome extension attack is similarly uncomfortable. Here, the entry point is an email. The victim's inbox contains a message with invisible prompt injection structures embedded in it. The victim doesn't need to click anything suspicious. Simply asking Claude to summarise recent emails is enough to trigger the attack, because the agent faithfully processes the hidden instructions alongside the visible content.
Standard safety filters would normally block direct script execution at this point, but Zenity found a workaround: host a malicious payload through a rogue CDN disguised as a legitimate NPM package. Claude gets tricked into calling what looks like an innocuous import, which quietly runs the attacker's code within the active browser session.
What that code can do is fairly alarming. Operating inside live session cookies, it can query Gmail's Atom feed, pull full email bodies, and exfiltrate inbox contents to an external server without any visible indication to the victim. It can also silently share everything in the user's Google Drive with an account the attacker controls.
For account takeover, the attack gets more involved. The script triggers a password reset or new sign-in on platforms like Slack or X, monitors Gmail for the incoming verification code, and relays that code to the attacker to complete the session hijack. Neat, horrible, and entirely automated.
Zenity reported the Claude findings to Anthropic in December 2025 and January 2026. Anthropic classified them as 'informative', which is presumably less exciting than Zenity was hoping for.
The Wider Problem
Both attack chains point to something uncomfortable about the current direction of AI tooling. Agentic systems that read content and act on it across authenticated sessions are, by their nature, a significant attack surface. The more permissions you hand an AI agent, the more a successful prompt injection is worth to an attacker. Neither of these vulnerabilities required a sophisticated zero-day exploit. They required planting some text in places the AI was going to read anyway.