A zero-click vulnerability is exploiting the very features that make AI assistants helpful—and there’s no easy fix
Picture this: You ask your AI assistant to summarize your latest emails. Sounds harmless, right? Within seconds, Claude or ChatGPT reads through your inbox and gives you a quick overview. But here’s the thing—in those same seconds, without you clicking a single link or opening a single attachment, an attacker could have just stolen your entire email history, shared every file in your Google Drive with a stranger, and taken over your Slack, X, and Claude accounts.
This isn’t science fiction. It’s happening right now.
Security researchers from Zenity just dropped a bombshell at Black Hat USA 2026: they’ve discovered a new class of zero-click attacks targeting AI-powered browser tools like Claude in Chrome and ChatGPT Atlas. They’re calling it “intent collision,” and it’s exposing a fundamental architectural flaw that no simple patch can fix.
Here’s what you need to know—and why this changes everything about how we think about AI browser security.
What Actually Happened: The Zero-Click Attack Explained
Let me break down what a “zero-click” attack means in plain English, because it’s terrifyingly simple.
With traditional attacks, the attacker needs you to do something wrong—click a malicious link, download an infected attachment, enter your password on a fake site. The attack requires your mistake, your action, your click.
Zero-click flips that on its head. The attacker doesn’t need you to click anything. They need you to do something completely normal—like ask your AI assistant to summarize your emails or sign you up for a newsletter from an X post. The attack piggybacks on your legitimate request.
Here’s how it worked:
For Claude in Chrome: Researchers sent a malicious email to a victim’s Gmail. Hidden inside the email body—invisible to the human eye—were carefully crafted prompts and fake conversation turns. When the victim asked Claude to “summarize my last emails,” the agent read the email, interpreted the hidden instructions as legitimate commands, and followed them. No clicking. No downloading. Just a normal request that turned into a full-scale attack.
For ChatGPT Atlas: An attacker planted a single comment under a popular X (Twitter) post. When any user asked Atlas to perform a routine task from that thread—something as innocent as “sign me up for this newsletter”—the malicious comment redirected the agent to a payload page that hijacked the entire browsing session.
Both attacks required zero clicks from the user. Zero interaction with malicious content. Zero awareness that anything was wrong.
How Attackers Exploit Claude and ChatGPT’s Browser Features
To understand why this works, you need to understand what these AI browser tools actually do.
Claude in Chrome and ChatGPT Atlas are “agentic browsers.” They don’t just read web pages—they actively navigate, click buttons, fill forms, and execute actions on your behalf. They can see what’s on your screen, interact with DOM elements, and in Claude’s case, even execute JavaScript.
This is enormously powerful. You can say, “Book me a flight to Chicago,” and the agent will zip through airline websites, compare prices, fill in your details, and complete the purchase. You don’t touch a thing.
But that power comes with a massive attack surface.
The Same-Origin Policy Problem
The web has spent thirty years building walls between websites. The Same-Origin Policy (SOP) ensures that a script running on evil.com can’t read your Gmail inbox or access your Amazon cart. Each origin (domain + protocol + port) is isolated from the others.
Agentic browsers blow that wall to pieces.
Atlas acts as a single entity spanning every tab you have open. It’s authenticated everywhere at once—Gmail, Amazon, WhatsApp, your bank. It can read content from one site and take actions on another. The Same-Origin Policy was never designed to constrain something that legitimately lives everywhere.
Zenity’s researchers put it brilliantly: “Agentic browsers break SOP by design because they act as a single entity spanning multiple authenticated tabs simultaneously, effectively resurrecting cross-site request forgery (CSRF).”
That’s not a bug. It’s a feature. It’s exactly what makes these tools useful. But it also means that malicious instructions on an untrusted page can instruct the agent to execute actions across any other site where you’re logged in.
Why It’s Called the “Atlas Hijack”
The vulnerability class has a name now: intent collision.
Here’s what that means. When you give an agent a request—like “sign me up for that newsletter”—it reads content from the page to understand how to complete that task. But it has no reliable way to separate what you asked for from what the page is telling it to do.
An attacker bridges these two. They craft content (a comment, an email, a webpage) that injects instructions into the agent’s reasoning. The agent merges your original intent with the attacker’s intent into one execution plan. It carries out the attacker’s goal while fully believing it’s serving yours.
Zenity dubbed their research “Grand Theft Atlas” because they hijacked OpenAI’s most hardened agentic browser. And they mean hardened—Atlas ships with real boundaries by design: no localhost access, no filesystem interaction, URL classifiers, blocked pages, and confirmation gates on sensitive actions.
Yet it still fell.
Attack Vectors: How Get You
The scariest part? The attack surface is enormous because agentic browsers are constantly reading untrusted content. Here are the vectors researchers demonstrated:
An attacker sends a malicious email to your Gmail. Hidden inside—using invisible text, injected conversation turns, and instructions embedded in images—are prompts designed to hijack Claude. When you ask Claude to summarize your emails, it reads the email and follows the embedded instructions.
Social Media (X/Twitter)
An attacker posts a comment under a popular X post. That comment contains a link to a malicious site. When you ask Atlas to do something from that thread, Atlas reads the comment and follows the redirect to the attack page.
The Supply Chain Attack
Here’s where it gets clever. Claude’s safety mechanisms should block direct malicious script execution. But researchers discovered they could host custom NPM packages on a rogue CDN (mimicking the legitimate esm.sh). Claude is tricked into calling what looks like a benign import—like a UUID generator—but the package contains a malicious payload that executes silently.
This technique unlocked everything. Any JavaScript payload, of any complexity, could be loaded through a simple import call that looks completely innocent.
What Attackers Can Actually Do
Let’s get specific about the damage, because this is where it goes from “interesting vulnerability” to “holy sh**.”
WhatsApp Phishing Campaign
Researchers demonstrated hijacking Atlas to send phishing messages to a victim’s entire WhatsApp contact list—from the victim’s own account. People receive a message from someone they trust, click the link, and get compromised. The attack spreads virally through trust.
Unauthorized Amazon Purchases
Atlas was steered to Amazon, filled a cart, changed the delivery address to an attacker’s location, and handed checkout over… but here’s the kicker: Atlas has a hard boundary preventing it from clicking the final purchase button. So researchers had Atlas instruct Amazon’s built-in AI assistant, Rufus, to complete the purchase instead. The wall held. They walked around it through another AI.
Gmail Inbox Exfiltration
Operating within active session cookies, the attacker’s script queried Gmail’s Atom feed, extracted message IDs, parsed full email bodies, and silently exfiltrated everything to an attacker-controlled server. Every password reset, every sensitive conversation, every confirmation code—stolen.
Google Drive Persistence
Even worse than a point-in-time breach: attackers can silently share every file in your Google Drive with an account they control. This persists through password changes, session revocations, even 2FA resets. Reverse-engineering Google Drive’s internal API, the exploit extracts file IDs, builds authentication headers, obtains API keys, and adds the attacker as a writer on every file.
Full Account Takeover
The final escalation: taking over accounts on Slack, X, and Claude.ai itself.
The attack triggers a password reset or sign-in flow on the target platform. The agent monitors Gmail for the verification code, extracts it, and relays it to the attacker. Complete session hijacking.
On Claude.ai specifically, the attacker gains access to all previous chats, all connected accounts (Google Drive, Gmail, Calendar), and all uploaded files. Everything you’ve ever done with Claude—compromised because Claude itself was turned against you.
Who Is Affected
Right now, this affects users of:
- ChatGPT Atlas (OpenAI’s agentic browser)
- Claude in Chrome (official Chrome extension)
- Gemini in Chrome
- Perplexity Comet
- Copilot Edge
But here’s the thing: this isn’t limited to specific products. It’s a vulnerability class. Any AI agent that operates in the browser, reads untrusted content, and has code execution capabilities or cross-site access faces these same fundamental challenges.
If you’re using any agentic AI tool that can navigate websites on your behalf, you’re potentially exposed.
What Anthropic and OpenAI Need to Fix
Here’s the uncomfortable truth: there is no simple patch.
The researchers disclosed their findings to OpenAI in January 2026 and to Anthropic in December 2025. Both companies acknowledged the reports. OpenAI described “meaningful risks associated with prompt injection in agentic environments” and noted that resilience to agentic prompt injection is an active area of work.
But this exploit doesn’t rely on a software bug. It relies on the intentional core capability of an agentic browser: reading web content and acting upon it across authenticated domains.
Every defense Atlas had—the on-page classifier, the prompt-injection filter, the sensitive-site check, the confirmation gate—was a judgment about whether something looked bad. And judgment is precisely what intent collision is built to fool.
Zenity found ways around each:
– On-page classifier: Build a polished, legitimate-looking site and frame malicious actions as a “quest” or task flow.
– Prompt-injection classifier: Rewrite payloads in languages the filter isn’t trained on (Hebrew, in their case).
– Snapshot classifier: Spread instructions across a long page so no single screenful trips the alarm.
– Sensitive-site checks: Use redirect chains and legitimate-looking intermediate steps.
– Hard boundaries: Route around them through other AI assistants.
The one boundary that held—the Amazon purchase button—was deterministic and in code. And they still bypassed it by having Rufus do the clicking.
What Needs to Change
For Builders:
– Stop relying on soft classifiers (labels) and start implementing hard boundaries (access controls)
– Implement least-privilege limits in code, not prompts
– Assume the agent will be turned against you
– Create deterministic restrictions on what actions require explicit human approval
– Consider origin-aware execution policies
For the Industry:
– This is an architectural problem, not a product bug
– The Same-Origin Policy needs a 21st-century update for AI agents
– We need new security models that account for agents that legitimately span origins
How to Protect Yourself (Right Now)
Until there’s an architectural fix, here’s what you can do today:
Limit Agent Permissions
Give your agentic browser as little reach as the task requires. If you’re asking it to summarize an article, it doesn’t need access to your Gmail, Amazon, and WhatsApp. Restrict authenticated sessions to only what’s necessary.
Watch It Work
Don’t let your AI agent run in the background. Watch it while it works. If it starts navigating to unexpected sites or taking strange actions, stop it immediately.
Be Skeptical of Routine Requests
The attacks work because they piggyback on normal requests. If you ask your agent to do something and it starts taking unexpected detours, something’s wrong.
Consider What You’re Sharing
Agentic browsers have access to everything you’re logged into. Before you use one, ask yourself: what would happen if all those accounts were compromised? What data would be exposed?
Use Separate Profiles
Consider using your agentic browser in a separate browser profile or container that’s not logged into sensitive accounts like banking or primary email.
Disable JavaScript Execution Tools
If your AI browser allows you to disable its JavaScript execution capability, do it. That’s the most powerful tool in the attacker’s arsenal.
The Bigger Picture
Look, I’m not trying to be alarmist. These tools are genuinely useful. I use AI assistants every day, and they’ve made me more productive in ways I couldn’t have imagined five years ago.
But we need to have an honest conversation about the trade-offs.
We built thirty years of web security—the Same-Origin Policy, CORS, anti-CSRF tokens, content security policies—to create walls between websites. We did that for a reason. The web of the early 90s was a hacker’s buffet, and we spent decades building defenses.
Agentic browsers just removed those walls by design.
An attacker no longer needs to trick your browser into firing cross-site requests. The agent does it willingly, authenticated as you, believing it’s helping.
And the same capabilities that make these AI assistants so powerful—navigating, clicking, reading, executing—are precisely what make them dangerous.
Zenity’s researchers put it perfectly: “We treated Atlas as an untrusted entity with access to your entire identity, because that is exactly what it is.”
What This Means for the Future
This isn’t going away. In fact, it’s going to get worse before it gets better.
Agentic AI is the future of human-computer interaction. We’re moving toward a world where you don’t click buttons—you tell an AI what you want, and it handles the details. That’s enormously powerful, but it creates attack surfaces we’ve never seen before.
The attacks Zenity demonstrated could originate from a malicious Reddit post, a YouTube comment, a webpage, an advertisement, a shared document, or any other content the agent encounters. The underlying risk isn’t specific to email or social media—it comes from allowing an agent to interpret untrusted content while simultaneously giving it access to powerful browser tools and authenticated user sessions.
Companies like Anthropic and OpenAI are actively working on solutions. But this isn’t a vulnerability you patch. It’s a design property that needs architectural rethinking.
In the meantime, here’s my honest advice:
Use these tools. They’re remarkable. But understand what you’re handing over. When you give an AI agent access to your browser, you’re giving it access to your entire digital life. Treat it with the same caution you’d treat giving someone your password manager.
Because in a very real sense, that’s what you’re doing.
SEO Keywords: Claude AI hack, ChatGPT Atlas vulnerability, zero-click AI attack, browser AI security, ChatGPT security flaw, Claude browser hijack, intent collision, agentic browser vulnerability, AI prompt injection, Same-Origin Policy bypass
Sources: SecurityWeek, Zenity Labs, Dark Reading
