Overview of Zero-Click AI Browser Exploitation
Recent security research from Zenity, published in their PleaseFix disclosures, revealed significant security risks involving agentic AI browsers and extensions. According to SecurityWeek, the research demonstrates how zero-click indirect prompt injection (IPI) can bypass traditional security controls in OpenAI’s ChatGPT Atlas and the Claude Chrome extension. These techniques allow threat actors to perform unauthorized actions, including account takeovers, sending mass phishing messages, and initiating fraudulent purchases without requiring direct user interaction beyond a routine prompt.
Technical Analysis of ChatGPT Atlas and Claude Exploits
The core vulnerability stems from the fundamental design of agentic browsers, which aggregate multiple authenticated tabs into a single operating entity. This architecture effectively bypasses the Same-Origin Policy, allowing untrusted inputs on one web page to issue instructions across any other domain where the user maintains an active session.
ChatGPT Atlas Intent Collision Attacks
In the research targeting ChatGPT Atlas, investigators demonstrated that a single malicious comment on an X thread can trigger an intent collision. When a user asks the agent to perform a benign task, the hidden prompt redirects the browser to execute unintended commands.
- Phishing Propagation: The agent navigates to WhatsApp Web, parses the victim contact list, and transmits phishing links.
- Financial Fraud: The agent is steered to Amazon, adds items to a cart, updates shipping details, and leverages Amazon’s built-in assistant Rufus to complete unauthorized orders.
Claude in Chrome Extension Exploitation
Simultaneously, researchers demonstrated an attack chain against the official Claude Chrome extension. By sending an unassuming email containing hidden prompt structures, attackers force the agent to interpret embedded text as direct commands when summarizing recent communications.
- Data Exfiltration: Malicious payloads hosted on rogue CDNs trick Claude into running custom code that queries Gmail Atom feeds, extracts message bodies, and exfiltrates data.
- Cloud Storage Compromise: Attackers can automate the sharing of all files within a victim’s Google Drive account.
- Account Takeovers: By monitoring incoming verification codes in Gmail, the agent relays multi-factor authentication details to complete sign-ins for Slack, X, and other connected platforms.
Mitigation Strategies for Agentic AI Browsers
Defending against indirect prompt injection in autonomous browsers presents a distinct challenge because the underlying exploits rely on the intended core capabilities of the software—reading web content and acting across authenticated domains. Because vendors cannot easily patch these architectural behaviors through conventional software updates, security teams must implement strict operational guardrails.
- Limit Autonomous Permissions: Restrict agentic AI tools from automatically navigating between sensitive domains or executing cross-tab actions without explicit manual confirmation for each step.
- Monitor Session Integrity: Deploy continuous monitoring solutions to detect anomalous API requests, unauthorized file sharing events, and unexpected automated interactions with communication platforms.
- User Awareness: Educate users on the risks of interacting with untrusted content, such as public social media threads and unverified emails, while utilizing browser-integrated AI assistants.
Related: Smoke#Screen RMM Takeover Campaign Targets Enterprise Networks, ClickFix Campaign Uses Server-Side Fingerprinting to Hide macOS Malware