Agentic browsers exist to do one thing: hold your logged-in sessions and act inside them on your behalf, so you can ask an assistant to book a flight or clear an inbox instead of doing it by hand. That convenience is also the entire attack surface Zenity's researchers used. SecurityWeek's writeup, published Thursday and updated Friday, covers two separate blog posts Zenity put out the same week under the shared name PleaseFix - one targeting OpenAI's ChatGPT Atlas, the other Anthropic's Claude in Chrome extension.
One comment on X, and the agent takes it from there
The Atlas attack is the more mechanical of the two. Zenity calls the technique "intent collision": a single comment planted on an X thread is enough to redirect an agent that was given an entirely unrelated, benign instruction by its actual user. Once hijacked, the agent - still operating inside the user's own authenticated browser tabs - reads their WhatsApp Web contact list, sends phishing messages to all of them, adds items to their Amazon cart, changes the delivery address, and instructs Amazon's own Rufus assistant to complete the purchase. None of it requires the victim to click anything. The agent was already trusted with the sessions; the attack just tells it what to do with that trust.
Claude in Chrome: from prompt injection to full account takeover
The Claude research goes a step further. Zenity embeds an invisible prompt inside an ordinary-looking email, uses rogue NPM packages hosted on custom CDNs to get past the agent's safety checks, then has the agent exfiltrate the contents of the victim's Gmail inbox using the session cookies it already holds. From there it silently shares Google Drive files with an attacker-controlled account and, for a final escalation, triggers an account recovery flow on Slack or X and has the agent watch the victim's own inbox for the verification code - relaying it straight to the attacker. Every step uses access the browser extension is supposed to have. The exploit doesn't defeat Claude's guardrails so much as walk around the side of them, through sessions the model was never asked to treat as untrusted.
Why "we told them" isn't the same as "it's fixed"
Zenity's disclosure timeline is the part worth sitting with longest. Findings went to Anthropic in December 2025 and January 2026, and were classified as "informative" - a status that, per SecurityWeek's reporting, means the report didn't get treated as an actionable bug to fix. OpenAI got its report in January 2026, acknowledged it, and has told Zenity there's no easy patch, because the technique exploits the browser's intentional core capability rather than a coding mistake. Both responses land in roughly the same place: this isn't a flaw a point release closes. It's a structural consequence of an agent holding several authenticated sessions at once and moving between them on the user's behalf - the same design tension this site raised when covering agentic browsers arriving in the enterprise and Cato's DuneSlide flaws in Cursor, and one that Anthropic's own agentic test-environment breakout earlier this month showed isn't limited to browsers either.
No CVE means no line item on your patch queue
There's a practical wrinkle here beyond the technical one. Neither PleaseFix disclosure carries a CVE number, because neither vendor treats this as a discrete, patchable vulnerability - it's an architecture question. That means it won't show up in a KEV feed, a CVSS-ranked ticket, or most vulnerability scanners. If your organisation's AI risk process is built around watching for numbered advisories, this is exactly the kind of finding it's built to miss.
- Inventory which employees have Claude in Chrome, ChatGPT Atlas or comparable agentic browser extensions installed, and what accounts those extensions can already reach when active - Gmail, Drive, Slack and X access is the material risk here, not the extension itself.
- Treat "no easy patch" as a governance decision to make now, not a technical fix to wait for - restrict agentic browser extensions on devices with access to corporate email, chat and file storage until session isolation genuinely improves.
- Don't rely on your vulnerability scanner or KEV feed to flag this class of issue - there's no CVE attached to either PleaseFix disclosure, so it won't appear in a CVSS-based patch queue.
- Check whether any account recovery or verification-code delivery in your organisation relies on email in a way an inbox-reading agent could intercept without anyone noticing.
- Ask any AI browser vendor directly what isolation exists between an agent's actions and the user's other authenticated tabs - not what content filtering exists, which is a different and weaker control.
The uncomfortable read on PleaseFix isn't that Zenity found a clever trick - it's that both vendors' responses amount to agreement that the trick works as intended, just aimed the wrong way. That's a harder problem than a missing patch, and it's one procurement and security teams need to own directly rather than wait out. If you want help assessing what your organisation's AI browser and agent footprint can already reach, email sales@halfteck.com.