Zero-Click AI Browser Hacking Targets Claude and ChatGPT Atlas
Researchers have uncovered zero-click vulnerabilities in Anthropic's Claude and OpenAI's ChatGPT Atlas, enabling attackers to hijack AI browser sessions via emails and social media posts without user interaction.
AI security firm Zenity has revealed critical zero-click vulnerabilities affecting Anthropic's Claude browser extension and OpenAI's ChatGPT Atlas agentic browser. These exploits allow attackers to compromise AI browser sessions, leading to account takeovers, phishing campaigns, and unauthorized transactions, all without requiring any user interaction.
The research highlights two distinct attack vectors. For ChatGPT Atlas, Zenity discovered that fundamental architectural design choices, rather than traditional software bugs, enable exploitation through 'intent collision.' By planting a single malicious comment on an X (formerly Twitter) thread, attackers can hijack legitimate user requests. Agentic browsers like Atlas inherently break the Same-Origin Policy (SOP) by design, allowing malicious instructions on one page to control the agent across any authenticated tab. Zenity demonstrated scenarios where Atlas could be manipulated to send phishing messages to a victim's contacts via WhatsApp Web or to add items to an Amazon cart and redirect them to an attacker-controlled address, even using Amazon's own AI assistant Rufus to complete the purchase.
Zenity disclosed these findings to OpenAI in January 2026. While OpenAI acknowledged the report, a straightforward patch is challenging because the exploit leverages the core functionality of an agentic browser: its ability to read web content and act upon it across authenticated domains. This means the vulnerability is deeply embedded in the intended operation of such AI agents.
In parallel, Zenity detailed a zero-click attack chain targeting the official Claude Chrome extension. This exploit leverages the elevated permissions granted to agentic browsers within active user sessions. Attackers can embed invisible prompt structures within malicious emails. When a user asks Claude to summarize an email, the AI interprets these hidden instructions as direct commands. While direct script execution is typically blocked by safety mechanisms, attackers can bypass these by hosting custom NPM packages on a rogue Content Delivery Network (CDN).
Claude can be tricked into importing a seemingly benign package, which then silently executes malicious payload code. This allows attackers to query Gmail's Atom feed, extract message IDs, parse full email bodies, and exfiltrate inbox contents to an attacker-controlled server. The exploit can also be used to silently share all files from a targeted user's Google Drive account with the attacker. Furthermore, Zenity demonstrated account takeovers for Slack and X, where the AI agent monitors Gmail for incoming verification codes to complete session hijacking.
These vulnerabilities were reported to Anthropic in December 2025 and January 2026, with the company classifying the findings as 'informative.' The research underscores the significant security risks associated with AI agents operating with broad web access and elevated privileges, especially when integrated into browser extensions or agentic browsing environments.
The implications of these findings are substantial, as they demonstrate a new class of vulnerabilities that bypass traditional security measures like multi-factor authentication and standard browser security models. The reliance on AI's ability to interpret and act on web content creates novel attack surfaces. As AI agents become more integrated into daily workflows, securing these systems against sophisticated prompt injection and indirect prompt injection attacks will be paramount.
Zenity's research serves as a critical warning to both AI developers and users. The lack of immediate patches for these fundamental architectural issues highlights the ongoing challenges in securing advanced AI systems. Users are advised to exercise extreme caution when interacting with AI assistants, particularly those with browser access, and to stay informed about vendor security advisories.