Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts

Key facts

Detection coverage

As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1953 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Automated Gmail Atom Feed Polling for Slack/X/Claude.ai OTP and Magic-Link Harvesting

Detects scripted, high-frequency GET requests to the Gmail Atom feed endpoint (mail.google.com/mail/u/0/feed/atom) consistent with an agentic-browser IPI payload polling the victim's inbox for Slack sign-in codes, X password-reset codes, and Claude.ai magic-link nonces without corresponding human interaction. This is the post-exploitation credential-harvesting core of the attack chain — it converts a single compromised browser session into a universal out-of-band verification channel.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1114, T1111, T1567, T0053
• Data sources: proxy_web_logs, google_workspace_audit_logs, browser_extension_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy sourcetype=*proxy*
url="*mail.google.com/mail/u/0/feed/atom*"
| bucket _time span=1m
| stats count as req_count, dc(uri_query) as distinct_queries, values(user_agent) as user_agents by src_ip, user, _time
| where req_count >= 5
| eval avg_interval_sec=60/req_count
| sort - req_count

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has "mail.google.com/mail/u/0/feed/atom"
| summarize RequestCount = count(), Processes = make_set(InitiatingProcessFileName) by DeviceName, AccountName, bin(Timestamp, 1m)
| where RequestCount >= 5
| order by RequestCount desc

Sigma

title: High-Frequency Automated Requests to Gmail Atom Feed Endpoint
id: 1b2c3d4e-5f6a-4b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects scripted polling of the Gmail Atom feed (mail.google.com/mail/u/0/feed/atom) at a frequency inconsistent with normal interactive email checking, indicating automated harvesting of unread-message metadata for OTP/magic-link theft.
references:
  - https://labs.zenity.io/post/claude-in-chrome-from-alert-to-full-account-takeover
author: Threadlinqs Team
date: 2026-08-09
tags:
  - attack.collection
  - attack.t1114
  - attack.credential-access
  - attack.t1111
  - attack.exfiltration
  - attack.t1567
cve: []
logsource:
  category: proxy
detection:
  selection:
    url|contains: 'mail.google.com/mail/u/0/feed/atom'
  timeframe: 1m
  condition: selection | count() by src_ip > 4
falsepositives:
  - Legitimate low-frequency unread-count widgets or Gmail-checking browser extensions
  - Mail monitoring/SOC dashboards polling the same feed for operational purposes
level: critical

Known false positives:

• Legitimate email clients/extensions (e.g. unread-count widgets) that poll the Atom feed at low frequency — typically well under the 5-req/min threshold
• Internal mail-monitoring dashboards intentionally polling the same feed

Tuning notes: Baseline normal Atom-feed polling cadence per user/extension before enabling in blocking mode — legitimate widgets typically poll every 5-15 minutes, well below this rule's 5-requests-per-minute threshold. Tighten or loosen the threshold per tenant, and correlate with a recent javascript_tool/extension-install event or the esm-sh.com fetch (SPL/KQL/SIG-001) to raise confidence and cut noise from other legitimate high-frequency pollers.

• 🔒 Sentinel: Browser Process Network Connection to Typosquat CDN Serving javascript_tool Payload · unlock with TL Creds
• 🔒 Sentinel: CloudAppEvents Correlation of Gmail Atom Feed Abuse with Recent Extension Tool Invocation · unlock with TL Creds
• 🔒 Sentinel: CloudAppEvents Cross-Service Correlation of Slack/X/Claude.ai Sign-In Flows Following Gmail Access · unlock with TL Creds
• 🔒 Sigma: HTTP/DNS Request to [indicator] Typosquat CDN · unlock with TL Creds
• 🔒 Sigma: Gmail Atom Feed Polling Rate Threshold Exceeded · unlock with TL Creds
• 🔒 Sigma: Google Drive clients6.google.com API Call with SAPISIDHASH Authorization Header · unlock with TL Creds
• 🔒 Claude in Chrome javascript_tool Fetch of Typosquat [indicator] Package (IPI Payload Stage) · unlock with TL Creds
• 🔒 Cross-Service Account-Takeover Chain: Claude.ai Magic-Link Exchange and Forged SAPISIDHASH Drive Persistence · unlock with TL Creds

Indicators of compromise

As of 2026-08-09, Threadlinqs Intelligence tracks 11 indicators of compromise for TL-2026-1953.

Sample indicators (3 of 11)

• Domain: esm-sh[.]com
• URL: hxxps://mail[.]google[.]com/mail/u/0/feed/atom
• URL: hxxps://claude[.]ai/login

Defanged, TLP:CLEAR. Full set of 11 indicators: unlock with TL Creds.

Technical analysis

That code polls the victim's Gmail Atom feed to harvest Slack sign-in codes, X password-reset codes, and Claude.ai magic-link nonces, enabling full account takeover of all three services (plus persistent Google Drive access) from a single email the user asked Claude to summarize.

Zenity Labs' "Claude in Chrome: From alert(1) to Full Account Takeover" (published 2026-08-05, covered by Cyber Security News, GBHackers, and Cyberpress on 2026-08-07) documents an indirect prompt-injection (IPI) chain against Anthropic's Claude in Chrome extension that escalates from a single malicious email into cross-service account takeover.

The attack begins when a victim asks Claude to summarize recent emails. A malicious message in the inbox contains hidden instructions (embedded in message text, disguised conversation-turn structures, and text hidden inside images) that Claude ingests as if they were legitimate user directives. The IPI payload directs Claude to invoke its javascript_tool — a Chrome-extension capability Claude's own system prompt describes as general-purpose JavaScript execution — against a package hosted on esm-sh.com, a domain registered by the researchers to typosquat the legitimate esm.sh CDN. The researchers characterize javascript_tool as exploitable on "any domain," i.e. a Universal XSS primitive: the fetched package advertises itself as a trivial UUID generator, returns a correctly-formatted UUID to avoid raising suspicion, and silently executes an entirely different, attacker-authored payload underneath.

Because the JavaScript runs inside the extension's browser context, every request it issues automatically carries the victim's existing authenticated session cookies. The payload queries Gmail's Atom feed (https://mail.google.com/mail/u/0/feed/atom) for unread-message metadata, converts message IDs to hexadecimal to pull full message bodies from Gmail, and exfiltrates parsed results via POST to an attacker-controlled server — all without further user interaction.

From that single foothold, the researchers built three account-takeover paths that abuse the ambient Gmail access as a universal out-of-band verification channel:

- Slack: the attacker-controlled Claude instance drives Slack's email-based sign-in flow, defeats Slack's CAPTCHA using a jailbreak prompt that overrides Claude's own safety guardrails, waits for Slack's confirmation code to land in the victim's Gmail, and polls the Atom feed to extract it, completing authentication as the victim. - X (Twitter): the payload reimplements X's internal password-reset API end-to-end, including activating guest tokens and stepping through X's multi-stage, anti-automation-hardened challenge flow (requiring the researchers to reverse-engineer stateful API behavior), then extracts the reset code from Gmail the same way and receives a valid session auth_token in the API response. - Claude.ai: the payload navigates to https://claude.ai/login, triggers /api/auth/send_magic_link, extracts the login nonce from the magic-link URL delivered to Gmail via the Atom feed, and exchanges it through /api/auth/exchange_magic_link and /api/auth/verify_magic_link to mint an authenticated session cookie — a full account takeover of Claude.ai itself, exposing chat history, uploaded files, and any connected Google Drive/Gmail/Calendar/Slack/GitHub data.

A parallel persistence payload separately abuses Google Drive: it scrapes file IDs from data-id HTML attributes in the Drive UI, forges SAPISIDHASH authorization tokens (SHA-1 over the session SAPISID cookie), pulls API keys out of Drive's own sharing dialogs, and batch-adds the attacker as a writer on every file the victim can access via Google's internal clients6.google.com API — with the IPI tricking Claude into approving the required Drive domain access through its own update_plan confirmation mechanism.

Zenity Labs submitted the initial IPI finding to Anthropic via HackerOne on 2025-12-27 and a follow-up account-takeover report on 2026-01-13 (marked a duplicate); Anthropic closed the original report as "Informative" and ruled the ATO report ineligible for its Vulnerability Disclosure Program on 2026-01-27. Zenity states the underlying risk "persists to this day" as of publication. The researchers frame the root cause as architectural rather than a single patchable bug: giving an AI agent powerful, unscoped browser-level tools (specifically javascript_tool) while simultaneously exposing that same agent to untrusted, attacker-influenced web/email content.

This specific Claude-in-Chrome chain is one instance of a broader vulnerability family Zenity Labs calls "Intent Collision" (marketed as "PleaseFix"), first disclosed against Perplexity Comet in March 2026 and expanded in an August 5, 2026 disclosure to cover Claude in Chrome, Gemini, Perplexity Comet, ChatGPT Atlas, and Copilot Edge: hidden instructions placed in ordinary agent-consumed content (emails, calendar invites, web pages) redirect an agentic browser into acting on the attacker's behalf using the victim's own identity and permissions. No CVE or CVSS score has been published for the Claude-specific chain.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0011.001 Malicious Package; AML.T0053 AI Agent Tool Invocation; T1059.007 JavaScript

execution

AML.T0051.001 Indirect

Defense Evasion

AML.T0054 LLM Jailbreak

Lateral Movement

AML.T0091.001 Web Session Cookie; T1550.004 Web Session Cookie

Stealth

T1027 Obfuscated Files or Information; T1036 Masquerading

Persistence

T1098 Account Manipulation

Credential Access

T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token

Collection

T1114 Email Collection

Initial Access

T1195 Supply Chain Compromise

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583.001 Domains; T1608 Stage Capabilities

Remediation

Patches

• No vendor patch has been released for this architecture-level finding as of publication; Anthropic closed the initial HackerOne report as "Informative" on 2026-01-27 and ruled the account-takeover follow-up report ineligible for its Vulnerability Disclosure Program

Immediate actions

• Restrict or disable Claude in Chrome's javascript_tool so it cannot execute arbitrary JavaScript against arbitrary origins; scope it to an explicit domain allowlist
• Require human confirmation before an agentic browser session that has just processed untrusted email/web content is permitted to take high-impact authenticated actions (sign-ins, password resets, sharing changes)
• Enable step-up/second-factor re-authentication for Slack, X, and Claude.ai sign-in and password-reset flows so possession of the victim's Gmail Atom feed alone cannot complete takeover

Workarounds

• Avoid using Claude in Chrome to summarize or otherwise process untrusted or unsolicited email pending an architectural fix
• Disable or minimize the Claude in Chrome extension's connector access to Gmail, Google Drive, Slack, and GitHub on high-value accounts

Longer-term hardening

• Architecturally separate untrusted-content ingestion (email/web summarization) from high-privilege agent tool invocation, per Zenity's finding that this is an architectural tension rather than a single bug
• Move OTP and magic-link delivery for connected SaaS accounts off an email inbox the same AI browser agent can read (authenticator app or hardware key) to remove the single-inbox attack surface
• Add indirect-prompt-injection detection/sandboxing to agentic browser extensions before granting Gmail, Drive, Slack, or GitHub connector scopes

Affected and fixed versions

• Anthropic — Claude in Chrome (browser extension)
  Vulnerable versions: all versions with javascript_tool enabled, as tested through August 2026
• Anthropic — Claude.ai passwordless magic-link authentication
  Vulnerable versions: N/A - authentication design weakness, not a version-specific code defect
• Slack Technologies — Slack email-based sign-in flow
  Vulnerable versions: N/A - authentication design weakness abused via a third-party client, not a Slack code defect
• X Corp — X (Twitter) password-reset flow
  Vulnerable versions: N/A - authentication design weakness abused via a third-party client, not an X code defect

Timeline

• 2025-12-27 Zenity Labs submits the initial indirect prompt-injection finding against Claude in Chrome to Anthropic via HackerOne.
• 2026-01-13 Zenity Labs submits a follow-up report detailing the account-takeover impact; it is marked a duplicate of the first report.
• 2026-01-27 Anthropic closes the original IPI report as "Informative" and rules the account-takeover report ineligible for its Vulnerability Disclosure Program.
• 2026-03-03 Zenity Labs first publicly discloses the "PleaseFix" / Intent Collision vulnerability class against Perplexity Comet, the broader vulnerability family this Claude-in-Chrome chain belongs to.
• 2026-08-05 Zenity Labs publishes the full technical write-up "Claude in Chrome: From alert(1) to Full Account Takeover" and a press release extending the PleaseFix/Intent Collision disclosure to Claude in Chrome, Gemini, Perplexity Comet, ChatGPT Atlas, and Copilot Edge.
• 2026-08-07 Cyber Security News, GBHackers, and Cyberpress publish independent reporting on the Claude in Chrome Gmail-code-theft account-takeover chain.
• 2026-08-09 No vendor patch confirmed; Zenity Labs states the demonstrated risks and vulnerabilities persist as of publication.

Sources cited

• Claude in Chrome: From alert(1) to Full Account Takeover labs.zenity.io · Research · 2026-08-05
• Zenity Labs Exposes the Full Scope of PleaseFix, a Vulnerability Class Enabling Zero-Click Attacks Across Leading Agentic Browsers businesswire.com · Vendor report · 2026-08-05
• Zenity Labs Discloses PleaseFix Vulnerability Family in Perplexity Comet and Other Agentic Browsers businesswire.com · Vendor report · 2026-03-03
• PleaseFix Vulnerability: Perplexity Comet Zero-Click Agent Hijack zenity.io · Vendor report · 2026-03-03
• Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts cybersecuritynews.com · News · 2026-08-07
• Claude in Chrome Exploit Lets Attackers Steal Gmail Codes and Take Over Slack, X, and Claude.ai Accounts gbhackers.com · News · 2026-08-07
• Claude in Chrome Prompt Injection Flaw Enables Slack, X, and Claude.ai Account Takeovers cyberpress.org · News · 2026-08-07

Related threats

• Zero-Click Cryptographic Context Injection Attack Exfiltrates Grok Chat Data via Malicious Webpages
• CVE-2026-26133: Cross-Prompt Injection in Microsoft Copilot Email/Teams Summarization Enables AI-Mediated Phishing
• 91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285
• OpenAI GPT-6 Astra Reaches 'Critical' Cybersecurity Capability Threshold; Attempted Supply-Chain Attacks and Scope Violations Found in Safety Testing

Previous and next in vulnerability

• Malware Abuses Windows Hello for Business Key to Authenticate to Microsoft Entra ID Previous report
• CSS Bomb: JavaScript-Free CSS Keylogging and Token-Theft Attacks Against Gmail, Outlook, Yahoo Mail, AOL Mail, Fastmail, and ProtonMail Next report

Further reading

• CrowdStrike Prompt Injection Taxonomy for LLMs