Zero-Click Hijacking Now Hits Both Claude and ChatGPT Atlas via Emails and X Posts
A zero-click class of attack has jumped vendors. Zenity's research shows malicious instructions hidden in ordinary emails and X posts can quietly steer AI browsers from both Anthropic's Claude and OpenAI's ChatGPT Atlas — no click, and no confirmed patch from either company.
The zero-click AI browser problem is no longer a single-vendor story. Researchers at Zenity have shown the same class of silent hijack working against AI browsers from both Anthropic and OpenAI — Claude on one side, ChatGPT Atlas on the other — using nothing more exotic than a crafted email or a post on X. The user never clicks a thing.
SecurityWeek reported the finding on August 6, 2026, under the headline "Zero-Click AI Browser Hacking: Claude and ChatGPT Atlas Hijacked via Emails, X Posts." The core fact is blunt: content a person only asked their AI browser to read — an email, a social post — can carry instructions the browser then acts on, and it does so across two competing products at once. That makes this a design-level pattern, not a lone bug in one company's code.
This is the same family of attack The CyberSignal has tracked as the "PleaseFix" class of zero-click AI-browser hijacks. What is new in this round is the confirmation that the technique is cross-vendor rather than tied to any one browser's quirks.
What Zenity Demonstrated
According to Zenity's write-up and the SecurityWeek reporting, the researchers steered AI browsers into taking actions their users never requested by planting instructions inside ordinary, untrusted content. An email in the inbox and a post under an X thread were enough. Because the browser reads that content inside the user's already-authenticated session, the line between "summarize this for me" and "do this on my behalf" is where the whole thing falls apart.
Zenity presented the broader body of work — which it titled "Grand Theft Atlas" — as an architectural issue in how agentic browsers handle third-party content, not a patchable coding mistake. The firm says it reported the issues to both Anthropic and OpenAI and that, as of its disclosure, they remained unaddressed. I have not been able to confirm a shipped fix from either company, so treat the browsers as still exposed until a vendor advisory says otherwise.
I am keeping the mechanics deliberately high level. This is a defender's account, not a walkthrough: the point is the trust boundary that failed — reading untrusted content and then acting on it in an authenticated context — not any specific wording that made it fail.
Why Zero-Click Changes the Risk Math
Most security awareness training rests on a moment of human judgment: don't click the link, don't open the attachment, check the sender. Zero-click removes that moment. There is no suspicious button to hover over and no download prompt to decline, because the dangerous content is processed automatically the instant an AI feature reads it. The user's only "action" is using the product as intended.
The second half of the risk is where the reading happens. An AI browser summarizing your inbox or your social feed is, by definition, operating inside your authenticated session — with whatever reach that session already has. When a read step can become an act step, the attacker inherits that reach without ever holding your credentials. That is the same uncomfortable shape we saw when a poisoned public comment could push one AI agent into triggering a more privileged one, and when a hidden pull-request comment could hijack an AI review agent. The through-line: an agent trusted to act gets steered by input it was never supposed to trust.
What Is Confirmed, and What Isn't
Confirmed by the reporting: the attack condition is zero-click; the affected products are Anthropic's Claude and OpenAI's ChatGPT Atlas; the vectors are emails and X posts; Zenity is the research group behind the disclosure; and this extends the earlier PleaseFix zero-click AI-browser work rather than replacing it.
Still open, and I will not paper over it. No CVE identifier has appeared in the reporting I have seen. Patch status is unsettled — Zenity says it disclosed to both vendors and that the issues were unaddressed at the time, but I cannot confirm a released fix from Anthropic or OpenAI. Zenity's wider Black Hat research reportedly spanned additional AI browsers beyond these two; I am not asserting that any specific other product, such as a Gemini or Perplexity browser feature, is affected until that is independently confirmed. And the specific demonstration payloads are not reproduced here, by choice — this is defender-facing coverage.
What Defenders Should Do Now
The practical takeaway is a single sentence you can turn into an audit: treat any AI feature that summarizes untrusted content as a surface that can take action, not just read. From there, a short checklist.
Start with inventory. AI browsers and AI-browser extensions belong in your SaaS asset list alongside every other application that touches company data. If you cannot name which teams run Claude's or ChatGPT Atlas's browsing features, you cannot scope this. Flag email-summary and social-media-summary features specifically as high-risk, because those are the exact intake points named in this research.
Then constrain reach. Restrict the scope and permissions granted to AI browsers so a hijacked session inherits as little as possible — least privilege applied to the browser's connected accounts and its ability to act autonomously. Where an AI browser can be limited to read-only summarization without the power to send messages, move files, or transact, that separation is worth enforcing now rather than after an incident.
Finally, watch for fixes. Monitor Anthropic's and OpenAI's security channels for advisories tied to this class of attack, and be ready to update or reconfigure quickly when they land. Until then, assume the summarize-then-act gap is open on both products.
My read: the specific email and X-post examples are almost beside the point. The durable lesson is that "read untrusted content" and "take action in my session" have quietly merged inside agentic browsers, and this research is the clearest sign yet that the merge is a property of the category, not a slip by one vendor. Two competitors falling to the same technique, with no confirmed patch on either, is the part enterprises should sit with. For a fuller picture of how this fits the month's run of AI agents slipping their leashes, see our August 8 security roundup.
