Zero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X Posts
Zero-click AI browser hacks target Claude and ChatGPT Atlas, enabling account takeovers and unauthorized purchases.
Zenity researchers have uncovered zero-click vulnerabilities in AI browsers like ChatGPT Atlas and the Claude Chrome extension. These exploits leverage indirect prompt injection and architectural design flaws to hijack user sessions, leading to account takeovers, phishing attacks, and unauthorized transactions on platforms like Amazon. The vulnerabilities remain unpatched due to their reliance on core agentic browser functionalities.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenAI?
Get an email when a new story names OpenAI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResearchers discovered critical zero-click vulnerabilities in AI-powered browser agents like ChatGPT Atlas and the Claude Chrome extension, exploitable through malicious content in emails and social media posts without any user interaction. The root cause lies in architectural design flaws that allow indirect prompt injection — where untrusted external content manipulates the AI agent into executing unauthorized commands. Because the vulnerabilities are baked into core agentic functionalities rather than simple software bugs, patches are difficult to deploy quickly, leaving users exposed to account takeovers and unauthorized financial transactions. This highlights the dangerous reality that AI agents operating with broad permissions and insufficient input validation create an entirely new attack surface that traditional security models are not designed to address.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — NPM packages