AI security firm Zenity disclosed 2 browser hacking techniques targeting Claude and ChatGPT Atlas for Chrome, showing they could enable account takeovers, phishing and unauthorized Amazon payments, Security Week reported on Aug. 6.

Zenity published the research in 2 blog posts on Aug. 5, the report said. One covered ChatGPT Atlas and the other addressed Claude for Chrome.

Zenity researchers said OpenAI’s agent-style browser ChatGPT Atlas is vulnerable to zero-click indirect prompt injection because of a fundamental structural design issue, rather than a typical software bug. They said agentic browsers such as Atlas operate as a single entity spanning multiple authenticated tabs, breaking the same-origin policy (SOP) by design. That allows untrusted page content to instruct actions across other sites where a user is logged in, they said.

The researchers demonstrated a scenario in which a legitimate request such as subscribing to a newsletter is intercepted to read contacts on WhatsApp Web and send phishing messages. They also showed a scenario in which items are added to an Amazon cart, the delivery address is changed to an attacker’s address and the purchase is completed through Amazon’s built-in AI assistant Rufus.

Zenity said it informed OpenAI of the findings in January 2026. OpenAI acknowledged the report but said a simple patch would be difficult because the issue stems from the core function of agentic browsers, which read web content and act across authenticated domains, Zenity added.

Zenity also demonstrated a zero-click attack chain targeting the official Claude extension for Chrome. It expands indirect prompt injection into a complete account takeover by exploiting the high privileges of an agent-style browser operating within an active session.

The researchers showed that a simple request to summarise a malicious email can cause a hidden prompt structure to be interpreted as a direct command, Security Week reported.

The research findings were delivered to Anthropic in December 2025 and January 2026 and were classified as for reference.