Summary
- Zenity demonstrated indirect prompt injection against Claude in Chrome using malicious content embedded in email.
- The research chained browser-agent capabilities across authenticated Gmail, Drive, Slack, X, and Claude services.
- Anthropic's own security material recognises indirect prompt injection as an ongoing risk for browser and computer-use agents.
Security researchers have demonstrated how malicious content processed by Anthropic’s Claude browser extension could lead to actions across several authenticated services, extending prompt-injection risk from manipulated model output into account authority.
Zenity tested Claude in Chrome, developed by Anthropic, and built controlled attack chains beginning with indirect prompt injection hidden inside email content.
In the researchers’ demonstration, a user could ask Claude to summarise recent messages without deliberately opening the malicious email. The agent read the content as part of the task and processed embedded instructions that Zenity designed to redirect its subsequent behaviour.
The researchers then used capabilities available through the extension to demonstrate activity affecting authenticated Google, Slack, X, and Claude sessions. The work includes account-takeover proof-of-concepts, although Zenity has not presented evidence that the attack chain has been used against customers outside its testing.
The technical sequence goes considerably further than ordinary prompt manipulation, but it depends on the authority and tooling available to the browser agent. Zenity’s research makes claims about how JavaScript execution, domain approvals, authenticated sessions, and indirect instructions could be chained together rather than identifying a conventional memory-safety vulnerability in Chrome itself.
The publication also records a disputed disclosure history. Zenity says it submitted related findings to Anthropic through HackerOne in December 2025 and January 2026 and that the reports were ultimately classified as informative, duplicate, or outside the vulnerability-disclosure programme.
Zenity says the demonstrated risks remained present when it published its research on 5 August. That is the researcher’s position, rather than an independent confirmation that every current Claude in Chrome configuration remains exploitable through the same chain.
Anthropic’s own security material acknowledges indirect prompt injection as an important threat to browser and computer-use agents. The company has developed additional safeguards and adaptive evaluations intended to measure whether models follow hostile instructions encountered while navigating websites.
Those safeguards reduce risk without turning the problem into a conventional patched-or-unpatched binary. Model behaviour, tool permissions, browser context, approval settings, and the exact attack content can all affect whether an attempted injection succeeds.
The architectural issue resembles the one exposed by other agentic-browser research this week. A browser agent can legitimately cross application boundaries because that is part of its usefulness. It can read email, open documents, navigate collaboration tools, and complete multistep tasks without requiring the user to perform each transition manually.
Traditional browser isolation remains present underneath that workflow, but the agent itself becomes an authorised participant in multiple services. If untrusted content can redirect its decisions, the practical security boundary is no longer limited to whether one website can directly read data from another.
This becomes particularly sensitive in enterprise environments. Corporate browser sessions may carry access to email, cloud storage, messaging, administrative systems, and customer applications simultaneously. A user may have completed strong authentication correctly before any malicious content is encountered.
Controls therefore have to address the authority delegated after login: which services an agent can enter, which actions it can perform automatically, where explicit confirmation is required, and whether untrusted content can influence decisions governing another domain.
Anthropic’s continuing investment in prompt-injection evaluations reflects how difficult that boundary is to make deterministic. Research results do not show that every browser agent can be taken over at will, but they do show why identity, browser security, and AI safety can no longer be treated as independent layers once a model is allowed to operate through authenticated sessions.
