Security researchers have demonstrated an indirect prompt-injection chain affecting Claude in Chrome that can transform a standard request, such as summarizing recent emails, into a cross-account takeover scenario.
The research reveals how untrusted content viewed by an AI browser agent can exploit authenticated browser sessions to steal email-delivered verification secrets and compromise accounts on services like Slack, X, and Claude.ai.
Claude in Chrome Exploit
The attack begins with a malicious email containing hidden instructions. When a user asks Claude in Chrome to review or summarize their inbox, the agent can mistakenly ingest these concealed instructions along with legitimate email content.
According to Zenity Labs, the injected content can trick the agent into using its browser-side JavaScript capabilities, leading to arbitrary code execution within the victim’s active web session.
Rather than including obviously malicious code, the proof of concept relies on a seemingly benign package imported from an attacker-controlled package registry masquerading as a trusted content delivery network.
This imported package provides the expected result, such as a valid UUID, while secretly executing additional browser-side logic. This technique is noteworthy because it hides malicious behavior from both the AI assistant and the user.
The core vulnerability enabling account takeovers is access to Gmail in an authenticated browser context. Zenity’s researchers demonstrated that code executed through the agent could query Gmail’s Atom feed, retrieve the metadata of recent unread emails, and identify verification messages from third-party services.
The browser automatically supplies the victim’s existing session cookies, eliminating the need for the attacker to authenticate separately with Gmail.
Once attackers can monitor incoming emails, password resets, sign-in codes, and passwordless “magic links” become high-value targets. The exploit chain can initiate an authentication or recovery flow using the victim’s email address, wait for the resulting message, capture the one-time secret, and relay it to the attacker.
SecurityWeek has independently summarized demonstrations involving the exfiltration of Gmail data and the theft of email codes used to take over Slack and X accounts.
Three Account-Takeover Paths
In the case of Slack, the research chain triggered an email-based login flow and captured the confirmation code sent to the victim’s inbox. An attacker could then use this code to complete the authentication process and gain access to the victim’s Slack identity and workspace data.
The X scenario involved a more complex password-reset workflow, which included anti-automation and browser-instrumentation stages. After the reset email arrived, the injected payload extracted the confirmation code, allowing the attacker-controlled process to finalize the reset and establish an authenticated session.
Claude.ai was the most consequential target. Researchers reported exploiting its passwordless magic-link flow by extracting a nonce from the victim’s incoming email, subsequently using it to establish a session.
A successful compromise of Claude.ai could expose chat history, uploaded files, and data accessible via previously authorized connectors such as Google Drive, Gmail, Calendar, Slack, or GitHub.
This is not a conventional single-site vulnerability; it reflects a broader trust-boundary problem: AI agents are asked to interpret untrusted web or email content while possessing powerful browser permissions and access to authenticated sessions.
Organizations should restrict agent-based browser access to sensitive applications, treat all external content as potentially adversarial, require explicit out-of-band approvals for account recovery actions, and prefer phishing-resistant authentication methods when available.
Users should also avoid allowing browser agents to summarize or act on sensitive inbox content until vendors can provide a stronger separation between untrusted instructions and user intent.
Zenity stated that its reports to Anthropic were submitted in late 2025 and early 2026 and were classified as informative.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
