Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts
Claude in Chrome Prompt Injection Steals Gmail Codes to (TL-2026-1953), also tracked as Intent Collision (PleaseFix vulnerability class), is a high-severity software vulnerability, first published 2026-08-09. It has no confirmed attribution, affects Anthropic Claude in Chrome (browser extension), maps to 17 MITRE ATT&CK / ATLAS techniques (AML.T0011.001, AML.T0051.001, AML.T0053), and is covered by 9 detection rules and 11 indicators of compromise.
Key facts for TL-2026-1953
- Threat ID
- TL-2026-1953
- Also known as
- Intent Collision (PleaseFix vulnerability class)
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-09
- Last reviewed
- 2026-08-09
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Claude in Chrome Prompt Injection Steals Gmail Codes to
Malware and tooling: javascript_tool
Zenity Labs researchers Raul Klugman-Onitza and João Donato demonstrated an indirect prompt-injection attack chain against the Claude in Chrome browser extension: a malicious email with hidden instructions manipulates Claude into loading an attacker-controlled JavaScript package from a fake CDN registry via its javascript_tool, running inside the victim's authenticated browser session. That code polls the victim's Gmail Atom feed to harvest Slack sign-in codes, X password-reset codes, and Claude.ai magic-link nonces, enabling full account takeover of all three services (plus persistent Google Drive access) from a single email the user asked Claude to summarize.
How Claude in Chrome Prompt Injection Steals Gmail Codes to works
Zenity Labs' "Claude in Chrome: From alert(1) to Full Account Takeover" (published 2026-08-05, covered by Cyber Security News, GBHackers, and Cyberpress on 2026-08-07) documents an indirect prompt-injection (IPI) chain against Anthropic's Claude in Chrome extension that escalates from a single malicious email into cross-service account takeover.
The attack begins when a victim asks Claude to summarize recent emails. A malicious message in the inbox contains hidden instructions (embedded in message text, disguised conversation-turn structures, and text hidden inside images) that Claude ingests as if they were legitimate user directives. The IPI payload directs Claude to invoke its javascript_tool — a Chrome-extension capability Claude's own system prompt describes as general-purpose JavaScript execution — against a package hosted on esm-sh.com, a domain registered by the researchers to typosquat the legitimate esm.sh CDN. The researchers characterize javascript_tool as exploitable on "any domain," i.e. a Universal XSS primitive: the fetched package advertises itself as a trivial UUID generator, returns a correctly-formatted UUID to avoid raising suspicion, and silently executes an entirely different, attacker-authored payload underneath.
Because the JavaScript runs inside the extension's browser context, every request it issues automatically carries the victim's existing authenticated session cookies. The payload queries Gmail's Atom feed (https://mail.google.com/mail/u/0/feed/atom) for unread-message metadata, converts message IDs to hexadecimal to pull full message bodies from Gmail, and exfiltrates parsed results via POST to an attacker-controlled server — all without further user interaction.
From that single foothold, the researchers built three account-takeover paths that abuse the ambient Gmail access as a universal out-of-band verification channel:
- Slack: the attacker-controlled Claude instance drives Slack's email-based sign-in flow, defeats Slack's CAPTCHA using a jailbreak prompt that overrides Claude's own safety guardrails, waits for Slack's confirmation code to land in the victim's Gmail, and polls the Atom feed to extract it, completing authentication as the victim. - X (Twitter): the payload reimplements X's internal password-reset API end-to-end, including activating guest tokens and stepping through X's multi-stage, anti-automation-hardened challenge flow (requiring the researchers to reverse-engineer stateful API behavior), then extracts the reset code from Gmail the same way and receives a valid session auth_token in the API response. - Claude.ai: the payload navigates to https://claude.ai/login, triggers /api/auth/send_magic_link, extracts the login nonce from the magic-link URL delivered to Gmail via the Atom feed, and exchanges it through /api/auth/exchange_magic_link and /api/auth/verify_magic_link to mint an authenticated session cookie — a full account takeover of Claude.ai itself, exposing chat history, uploaded files, and any connected Google Drive/Gmail/Calendar/Slack/GitHub data.
A parallel persistence payload separately abuses Google Drive: it scrapes file IDs from data-id HTML attributes in the Drive UI, forges SAPISIDHASH authorization tokens (SHA-1 over the session SAPISID cookie), pulls API keys out of Drive's own sharing dialogs, and batch-adds the attacker as a writer on every file the victim can access via Google's internal clients6.google.com API — with the IPI tricking Claude into approving the required Drive domain access through its own update_plan confirmation mechanism.
Zenity Labs submitted the initial IPI finding to Anthropic via HackerOne on 2025-12-27 and a follow-up account-takeover report on 2026-01-13 (marked a duplicate); Anthropic closed the original report as "Informative" and ruled the ATO report ineligible for its Vulnerability Disclosure Program on 2026-01-27. Zenity states the underlying risk "persists to this day" as of publication. The researchers frame the root cause as architectural rather than a single patchable bug: giving an AI agent powerful, unscoped browser-level tools (specifically javascript_tool) while simultaneously exposing that same agent to untrusted, attacker-influenced web/email content.
This specific Claude-in-Chrome chain is one instance of a broader vulnerability family Zenity Labs calls "Intent Collision" (marketed as "PleaseFix"), first disclosed against Perplexity Comet in March 2026 and expanded in an August 5, 2026 disclosure to cover Claude in Chrome, Gemini, Perplexity Comet, ChatGPT Atlas, and Copilot Edge: hidden instructions placed in ordinary agent-consumed content (emails, calendar invites, web pages) redirect an agentic browser into acting on the attacker's behalf using the victim's own identity and permissions. No CVE or CVSS score has been published for the Claude-specific chain.
MITRE ATT&CK / ATLAS techniques used in TL-2026-1953
Execution
AML.T0011.001 Malicious Package; AML.T0053 AI Agent Tool Invocation; T1059.007 JavaScript
execution
AML.T0051.001 Indirect
Defense Evasion
AML.T0054 LLM Jailbreak
Lateral Movement
AML.T0091.001 Web Session Cookie; T1550.004 Web Session Cookie
Stealth
T1027 Obfuscated Files or Information; T1036 Masquerading
Persistence
Credential Access
T1111 Multi-Factor Authentication Interception; T1528 Steal Application Access Token
Collection
Initial Access
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Affected products and versions in Claude in Chrome Prompt Injection Steals Gmail Codes to
- Anthropic — Claude in Chrome (browser extension)
Vulnerable versions: all versions with javascript_tool enabled, as tested through August 2026 - Anthropic — Claude.ai passwordless magic-link authentication
Vulnerable versions: N/A - authentication design weakness, not a version-specific code defect - Slack Technologies — Slack email-based sign-in flow
Vulnerable versions: N/A - authentication design weakness abused via a third-party client, not a Slack code defect - X Corp — X (Twitter) password-reset flow
Vulnerable versions: N/A - authentication design weakness abused via a third-party client, not an X code defect
Remediation for Claude in Chrome Prompt Injection Steals Gmail Codes to
Patches
- No vendor patch has been released for this architecture-level finding as of publication; Anthropic closed the initial HackerOne report as "Informative" on 2026-01-27 and ruled the account-takeover follow-up report ineligible for its Vulnerability Disclosure Program
Immediate actions
- Restrict or disable Claude in Chrome's javascript_tool so it cannot execute arbitrary JavaScript against arbitrary origins; scope it to an explicit domain allowlist
- Require human confirmation before an agentic browser session that has just processed untrusted email/web content is permitted to take high-impact authenticated actions (sign-ins, password resets, sharing changes)
- Enable step-up/second-factor re-authentication for Slack, X, and Claude.ai sign-in and password-reset flows so possession of the victim's Gmail Atom feed alone cannot complete takeover
Workarounds
- Avoid using Claude in Chrome to summarize or otherwise process untrusted or unsolicited email pending an architectural fix
- Disable or minimize the Claude in Chrome extension's connector access to Gmail, Google Drive, Slack, and GitHub on high-value accounts
Longer-term hardening
- Architecturally separate untrusted-content ingestion (email/web summarization) from high-privilege agent tool invocation, per Zenity's finding that this is an architectural tension rather than a single bug
- Move OTP and magic-link delivery for connected SaaS accounts off an email inbox the same AI browser agent can read (authenticator app or hardware key) to remove the single-inbox attack surface
- Add indirect-prompt-injection detection/sandboxing to agentic browser extensions before granting Gmail, Drive, Slack, or GitHub connector scopes
Timeline of Claude in Chrome Prompt Injection Steals Gmail Codes to
- Zenity Labs submits the initial indirect prompt-injection finding against Claude in Chrome to Anthropic via HackerOne.
- Zenity Labs submits a follow-up report detailing the account-takeover impact; it is marked a duplicate of the first report.
- Anthropic closes the original IPI report as "Informative" and rules the account-takeover report ineligible for its Vulnerability Disclosure Program.
- Zenity Labs first publicly discloses the "PleaseFix" / Intent Collision vulnerability class against Perplexity Comet, the broader vulnerability family this Claude-in-Chrome chain belongs to.
- Zenity Labs publishes the full technical write-up "Claude in Chrome: From alert(1) to Full Account Takeover" and a press release extending the PleaseFix/Intent Collision disclosure to Claude in Chrome, Gemini, Perplexity Comet, ChatGPT Atlas, and Copilot Edge.
- Cyber Security News, GBHackers, and Cyberpress publish independent reporting on the Claude in Chrome Gmail-code-theft account-takeover chain.
- No vendor patch confirmed; Zenity Labs states the demonstrated risks and vulnerabilities persist as of publication.
Sources cited for Claude in Chrome Prompt Injection Steals Gmail Codes to
- Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts
- Claude in Chrome: From alert(1) to Full Account Takeover
- Claude in Chrome Exploit Lets Attackers Steal Gmail Codes and Take Over Slack, X, and Claude.ai Accounts
- Claude in Chrome Prompt Injection Flaw Enables Slack, X, and Claude.ai Account Takeovers
- Zenity Labs Exposes the Full Scope of PleaseFix, a Vulnerability Class Enabling Zero-Click Attacks Across Leading Agentic Browsers
- Zenity Labs Discloses PleaseFix Vulnerability Family in Perplexity Comet and Other Agentic Browsers
- PleaseFix Vulnerability: Perplexity Comet Zero-Click Agent Hijack
Threats related to Claude in Chrome Prompt Injection Steals Gmail Codes to
- Zero-Click Cryptographic Context Injection Attack Exfiltrates Grok Chat Data via Malicious Webpages
- CVE-2026-26133: Cross-Prompt Injection in Microsoft Copilot Email/Teams Summarization Enables AI-Mediated Phishing
- 91 Spring Framework CVEs Disclosed by Broadcom, Including Critical Deserialization Flaw CVE-2026-59285
- OpenAI GPT-6 Astra Reaches 'Critical' Cybersecurity Capability Threshold; Attempted Supply-Chain Attacks and Scope Violations Found in Safety Testing
Detection coverage for TL-2026-1953
As of 2026-08-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1953 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.