Zero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X Posts

What it is

Zenity's "PleaseFix" research (two blog posts) demonstrating zero-click indirect prompt injection against OpenAI's ChatGPT Atlas and the official Claude in Chrome extension. The summary already covers the attack chains; what it omits is the vendor response and why no fix is coming.

Preconditions / Affected

Both attacks are zero-click in the sense that the victim only needs to ask the agent to do something routine — summarize recent emails (Claude), or sign up for a newsletter from an X post (Atlas). The malicious instructions ride in content the agent is already reading: a planted X comment, or an email with invisible prompt structures. Exploitation depends on the agent operating inside the user's active authenticated sessions.

What to do — the disclosure status

This is the part the summary does not carry, and it's the deciding factor:

• ChatGPT Atlas: Disclosed to OpenAI in January 2026. OpenAI acknowledged the report, but Zenity states there is no easy patch — the exploit relies on the intentional core capability of an agentic browser (reading web content and acting across authenticated domains), not a software bug. Atlas breaks Same-Origin Policy by design, acting as one entity across multiple authenticated tabs, which resurrects CSRF.
• Claude in Chrome: Reported to Anthropic in December 2025 and January 2026, and classified as 'informative' — i.e., not treated as a fixable vulnerability warranting a patch.

For an engineer, the takeaway: neither vendor is shipping a fix. There is no version boundary to wait for. If you deploy either agentic browser against accounts with sensitive session state (Gmail, Drive, Slack, X, WhatsApp Web, Amazon), you own the residual risk today. Mitigation has to come from your side — scoping which authenticated sessions the agent can touch, not from a patch.

Caveats

The Claude chain's script execution bypass depends on hosting a payload as a custom NPM package on a rogue CDN so Claude calls a benign-looking import; standard safety mechanisms do block direct malicious script execution. The Atlas Amazon scenario still can't click the final purchase button directly — it delegates that to Amazon's own Rufus assistant. These are demonstrated research attacks, not observed in-the-wild campaigns.