Zenity Demonstrates Zero-Click Account Takeovers in Claude and ChatGPT Atlas
Summary
Zenity’s PleaseFix research demonstrated zero-click prompt-injection attacks against ChatGPT Atlas and Claude in Chrome, enabling phishing, account takeovers, data exfiltration and unauthorized purchases. OpenAI acknowledged the findings; Anthropic classified them as ““
Key points
- Zenity said a planted X comment could hijack ChatGPT Atlas across authenticated tabs, exploiting the browser’s cross-site access by design.
- In a demonstration, Atlas was steered to read WhatsApp Web contacts and send them phishing messages.
- Another Atlas scenario redirected an Amazon purchase and shipping address; Atlas then instructed Amazon’s Rufus assistant to place the order.
- Zenity demonstrated a Claude in Chrome attack in which hidden instructions in an email prompted the assistant to act on them.
- The Claude attack used a rogue CDN-hosted NPM package to execute code that could extract Gmail messages and share Google Drive files.
- Zenity also demonstrated attacks targeting Slack and X accounts by relaying email verification codes to an attacker.
- OpenAI acknowledged the Atlas report, with Zenity saying there was no easy patch; Anthropic classified the reported findings as “informative.”
Article Details
- Attack Vectors
- A planted X-thread comment used indirect prompt injection to redirect ChatGPT Atlas and make it act across the user's authenticated web sessions.
- A malicious email containing invisible prompt instructions caused Claude in Chrome to interpret them as commands when asked to summarize emails.
- A rogue CDN hosted custom NPM packages that Claude was tricked into importing, leading to silent payload execution.
- Using active session cookies, the injected script queried Gmail's Atom feed, extracted email contents, and exfiltrated them to an attacker server.
- The agent was induced to share Google Drive files with an attacker-controlled account and to relay email verification codes for account takeover.
MITRE ATT&CK
T1114.002 · Remote Email CollectionThe injected script queried Gmail's Atom feed, extracted message IDs, and parsed email bodies from the victim's account.T1530 · Data from Cloud StorageThe attacker could cause the agent to share files from the victim's Google Drive with an account the attacker controlled.T1550.004 · Web Session CookieThe attack used the agent's access to active user-session cookies to act within authenticated web sessions.
Vendors
AnthropicThe findings were reported to Anthropic in December 2025 and January 2026, and were classified as ‘informative’.OpenAIZenity researchers discovered that OpenAI’s agentic browser, ChatGPT Atlas, is vulnerable to zero-click indirect prompt injection (IPI) due to fundamental architectural design issues rather than traditional softwareZenityAI security company Zenity has disclosed the details of two AI browser hacking techniques targeting Claude in Chrome and ChatGPT Atlas, demonstrating how they can be used for account takeovers, phishing, and making
Products
AmazonAtlas, demonstrating how they can be used for account takeovers, phishing, and making unauthorized Amazon purchases.ChatGPT AtlasZenity has disclosed the details of two AI browser hacking techniques targeting Claude in Chrome and ChatGPT Atlas, demonstrating how they can be used for account takeovers, phishing, and making unauthorized AmazonClaudeAI security company Zenity has disclosed the details of two AI browser hacking techniques targeting Claude in Chrome and ChatGPT Atlas, demonstrating how they can be used for account takeovers, phishing, and makingClaude in ChromeAI security company Zenity has disclosed the details of two AI browser hacking techniques targeting Claude in Chrome and ChatGPT Atlas, demonstrating how they can be used for account takeovers, phishing, and makingGmailThe researchers demonstrated how, operating within active session cookies, the attacker’s script queries Gmail’s Atom feed, extracts message IDs, parses full email bodies, and silently exfiltrates inbox contents to theGoogle DriveThe attacker can also silently share every file in the targeted user’s Google Drive account with an account they control.RufusTo bypass restrictions that prevent it from clicking the final purchase button, Atlas instructs Amazon’s built-in AI assistant Rufus to place the order instead.SlackZenity also demonstrated account takeover against Slack and X accounts.WhatsAppA specially crafted X comment redirects Atlas to a malicious payload page. The agent then navigates to WhatsApp Web, reads the victim’s contact list, and sends phishing messages to every contact.XBy exploiting ‘intent collision’ through a single planted comment on an X thread, researchers demonstrated how an attacker can hijack benign user requests to control the agent across authenticated web sessions.