Zero-click prompt injection can hijack agentic AI browsers through content a user never deliberately opens, according to research published by Zenity Labs on August 5. The firm demonstrated separate chains against ChatGPT Atlas and the Claude in Chrome extension that could abuse authenticated sessions for phishing, data theft, account takeover and an unauthorized online purchase. SecurityWeek independently reported the findings on August 6.

The demonstrations are security research, not evidence of attacks in the wild. Zenity said it reported the Atlas findings to OpenAI in January and received an acknowledgment in February. Its Claude reports were submitted to Anthropic in December 2025 and January 2026; Zenity said they were closed as informative or duplicate, and that the demonstrated risks remained when the research was published.

In the Atlas test, an attacker-controlled comment beneath an X post redirected the browser agent while it handled an ordinary newsletter request. Zenity called the technique intent collision: untrusted page instructions became part of the agent's plan while it retained access to other logged-in tabs. Researchers showed Atlas sending phishing messages through WhatsApp Web and changing an Amazon cart and delivery address. When Atlas refused to press the final purchase button, Amazon's Rufus assistant completed the order at Atlas's request.

The Claude in Chrome chain began with hidden instructions inside an email. When the test user asked Claude to summarize recent messages, the extension processed the injected content and invoked its JavaScript tool. Zenity used an attacker-controlled package registry that resembled a legitimate JavaScript CDN to load code while returning an expected value, allowing the demonstration to extract Gmail content and share Google Drive files.

Researchers also demonstrated password-reset and sign-in abuse against Slack, X and Claude.ai by monitoring the victim's Gmail session for verification material. The activity ran with the user's existing browser identity, illustrating how an agent that can read untrusted content and act across authenticated services can cross boundaries that normally isolate websites. Zenity did not assign CVE identifiers and described the issue as an architectural risk rather than a conventional software flaw.

Zenity recommended hard, deterministic restrictions and least-privilege access instead of relying only on classifiers or confirmation prompts. Users and organizations should limit which accounts and services an agentic browser can reach, avoid persistent high-value sessions, supervise sensitive actions and treat external emails, comments and documents as untrusted input. Until product-level controls provide stronger isolation, defenders should review agent activity and connected-account permissions for unexpected actions.