Zenity researchers revealed two zero-click attack chains against AI agentic browsers: ChatGPT Atlas and Claude in Chrome. ChatGPT Atlas is vulnerable to indirect prompt injection via 'intent collision' on X posts, allowing attackers to hijack authenticated sessions and perform actions like sending phishing messages or making unauthorized Amazon purchases by abusing the agent's ability to act across multiple authenticated tabs. Claude in Chrome is susceptible to a zero-click attack where malicious emails with invisible prompt structures cause the agent to execute hidden commands, enabling full account takeover, data exfiltration from Gmail and Google Drive, and hijacking Slack and X accounts by intercepting verification codes. These exploits stem from fundamental architectural design choices rather than traditional software bugs. Both OpenAI and Anthropic were notified months ago but have not issued patches due to the complexity of mitigating these core design issues.

The vulnerabilities enable attackers to hijack AI agentic browsers to perform unauthorized actions across authenticated web sessions, including phishing contacts, exfiltrating email and cloud storage contents, taking over user accounts on multiple platforms, and making unauthorized purchases. These impacts compromise user privacy, data confidentiality, and account integrity. Because the attacks require no user interaction (zero-click), they pose a significant risk to affected users. The exploits leverage the agentic browsers' elevated permissions and their design to operate across multiple authenticated domains, effectively bypassing same-origin policy protections.

As of the latest disclosure, no official patches or fixes are available from OpenAI or Anthropic. The vendors acknowledge the issues but have classified them as challenging to patch due to their basis in core architectural features of agentic browsers. Users and administrators should monitor vendor advisories for updates. Until official mitigations are released, caution is advised when interacting with AI agentic browsers, especially regarding unsolicited emails or social media content that could trigger these attacks. No direct mitigation steps are currently provided by the vendors.