Loading story…
Researchers disclosed a critical zero-click vulnerability chain in Anthropic’s Claude Chrome extension that allowed a malicious website to inject prompts into the AI assistant without any user interaction. The attack relied on the extension trusting any *.claude.ai origin and a DOM-based XSS flaw in an older Arkose Labs CAPTCHA component hosted on a-cdn.claude.ai; by loading the vulnerable component in a hidden iframe and sending a crafted postMessage, attacker-controlled JavaScript could appear to come from a trusted Claude origin and submit prompts as the victim.
Successful exploitation could have exposed more than 3 million users to account and data compromise, including theft of Gmail OAuth tokens, access to Gmail, Google Drive, and Claude chat history, and invisible actions such as sending emails on the user’s behalf. KOI Security researcher Oren Yomtov reported the issue to Anthropic in late December 2025, Anthropic patched the extension by tightening origin validation to https://claude.ai in January 2026, and Arkose Labs separately fixed the XSS issue in February 2026 after the vulnerable resource was disabled.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers publicly revealed that the chained flaws could have allowed silent prompt injection against Claude Chrome extension users, potentially exposing conversation history, Gmail and Drive data, OAuth tokens, and enabling actions such as sending emails on a victim's behalf. Reports said the issue affected a user base of more than 3 million before the fixes were applied.
Arkose Labs patched the vulnerable CAPTCHA component, and the previously exploitable URL later returned HTTP 403. This remediation closed the XSS portion of the exploit chain used against the Claude extension.
The DOM-based XSS vulnerability in the Arkose Labs CAPTCHA component hosted on a-cdn.claude.ai was separately disclosed to Arkose Labs. This second flaw was necessary for the full exploit chain because it enabled attacker-controlled JavaScript execution from a trusted Claude subdomain.
Anthropic fixed the extension-side issue by tightening trusted origin checks from any claude.ai subdomain to exactly https://claude.ai. This patch blocked malicious websites from abusing the extension's overly broad allowlist to send trusted messages without user interaction.
KOI Security researcher Oren Yomtov responsibly disclosed a zero-click prompt-injection vulnerability chain affecting Anthropic's Claude Chrome extension. The issue combined an overly broad *.claude.ai trusted-origin allowlist with a DOM-based XSS flaw in an Arkose Labs CAPTCHA component hosted on a-cdn.claude.ai.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
socradar.io
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at LayerX disclosed a critical flaw in Anthropic’s Claude Chrome extension that allowed **any other Chrome extension**, including ones with no declared permissions, to send hidden instructions to Claude and abuse its browser automation features. The issue reportedly stemmed from the extension trusting messages associated with the `claude.ai` origin without properly authenticating the true sender, creating a cross-extension privilege escalation path. In proof-of-concept attacks, LayerX said it used the weakness to extract files from Google Drive, read and send Gmail messages, steal code from connected private GitHub repositories, and even summarize or delete recent emails to conceal activity. Anthropic said the bug had already been identified internally and released version `1.0.70` with mitigations, including approval flows for privileged actions, but LayerX reported that the fix was incomplete and that takeover remained possible through privileged mode and side-panel initialization paths. The researchers said the flaw exposed a broader trust-boundary problem in AI browser assistants, where interface-based approvals and safety guardrails can be bypassed if extensions fail to verify message origin and execution context. Separate White House discussions about tighter oversight of advanced AI models, including Anthropic systems with offensive cyber capabilities, underscored growing concern over how powerful AI tools are secured before deployment.
Jun 29, 2026
Researchers at Manifold disclosed two unpatched vulnerabilities in Anthropic’s **Claude for Chrome** extension that can let a malicious browser extension trigger Claude actions and access sensitive Google Workspace content, including **Gmail messages, Google Docs data and comments, and Google Calendar entries**. The researchers said the flaws were reported in May and remained reproducible in version `1.0.80`, with one issue allowing another extension that has script access on `claude.ai` to simulate a trusted user click and launch hardcoded Claude prompts on the victim’s behalf. The weaknesses stem in part from Anthropic’s earlier mitigation for **ClaudeBleed**, which limited prompts to pre-approved tasks but did not verify that task-triggering clicks came from a real user. Manifold also identified a separate design flaw in which Claude’s side panel can enter a privileged **no-confirmation** mode through a URL parameter, creating a potential privilege-escalation path if a future bug allows outside control of that parameter. The risk is highest when users enable Claude’s **“Act without asking”** mode, because the extension may perform actions without visible consent prompts; Anthropic acknowledged the reports but had not issued fixes, saying one issue was already tracked internally and the other was not externally reachable.
Jul 17, 2026
Zenity disclosed zero-click attacks that hijacked **OpenAI’s ChatGPT Atlas** and **Anthropic’s Claude in Chrome** by embedding malicious instructions in content the agents were allowed to read, including X posts and email messages. In the Atlas demonstrations, a planted X comment exploited **intent collision** to redirect a benign task into phishing messages sent from the victim’s authenticated **WhatsApp Web** session, and a separate chain steered Atlas into making an unauthorized **Amazon** purchase by abusing Amazon’s **Rufus** assistant to finish the order. Researchers said Atlas’s prompt-based guardrails and classifiers could be bypassed by distributing instructions across page elements, using alternate language text, and making the malicious action appear aligned with the user’s original goal. A parallel attack against **Claude in Chrome** used indirect prompt injection in an email and a rogue `NPM` package served from a malicious CDN to escalate into JavaScript execution inside the victim’s active browser sessions. Zenity said the chain enabled Gmail inbox theft, persistent Google Drive sharing abuse, and takeover of **Slack**, **X**, and **Claude.ai** accounts by intercepting verification codes from Gmail. The findings were framed as an architectural risk in agentic browsers that can act across authenticated sessions, effectively recreating **CSRF-like cross-origin abuse** at the AI agent layer; Zenity said it reported the Atlas issues to OpenAI and the Claude issues to Anthropic months earlier, but the attacks remained exploitable or were treated as informational at publication time.
Aug 7, 2026