How does Zenity's PleaseFix turn ChatGPT Atlas and Claude in Chrome into zero-click account-takeover tools?

13 August 2026 8 min read 1664 words

At Black Hat USA 2026 (5 August), Zenity Labs disclosed PleaseFix — zero-click prompt injection that hijacks five agentic browsers: ChatGPT Atlas, Claude in Chrome, Gemini in Chrome, Perplexity Comet, Copilot in Edge. In Atlas, a single X comment made the agent exfiltrate WhatsApp contacts, send phishing, modify the Amazon address, and ask Rufus to finalise an unauthorised purchase. In Claude in Chrome, invisible email text made the agent forward Gmail, share Drive, and reset Slack/X passwords via Gmail codes. Both vendors downgraded the issues; no easy patch. An employee connecting personal Gmail to an agentic browser is one planted prompt from a takeover that bypasses MFA and the SSO.

Key facts

Zenity Labs (Israel) presented PleaseFix at Black Hat USA 2026 on 5 August 2026, with a follow-up press cycle on 6–7 August across SecurityWeek, Dark Reading, Calcalist, Ynet, and Notebookcheck. The disclosure expands PleaseFix research first published in March 2026.
Five agentic browsers are affected: ChatGPT Atlas (OpenAI), Claude in Chrome (Anthropic), Gemini in Chrome (Google), Perplexity Comet, and Microsoft Copilot in Edge. The Atlas and Chrome demos are the most fully described; the others are listed as part of the same vulnerability class.
ChatGPT Atlas (OpenAI) — "Intent Collision": a single X/Twitter comment planted with hidden instructions is enough to redirect Atlas. The agent opens WhatsApp Web, exfiltrates the victim's contacts, and sends phishing messages. It then navigates to Amazon, modifies the shipping address, and — when OpenAI's own guardrails refuse checkout — asks Amazon's Rufus assistant to finalise the purchase on the user's behalf.
Claude in Chrome (Anthropic) — zero-click via email: invisible prompt text hidden in an email body triggers actions when the user asks Claude to "summarise my emails." The agent has been shown forwarding the Gmail inbox, sharing Google Drive documents with an attacker-controlled account, and initiating password reset flows for Slack and X that use Gmail-delivered codes — which the agent can read. A rogue NPM package published to a rogue CDN was used to bypass sandboxing.
Vendor responses diverge from the risk picture. OpenAI acknowledged the issue in January 2026 but stated there is no easy fix because the Standard Operating Procedure that Atlas follows is "broken by design" at the architectural level. Anthropic classified the Claude in Chrome report as "informative" and has not committed to a behavioural patch.
The attack requires zero clicks from the victim. The user does not need to interact with the malicious content directly; the agent ingests it during a routine summary or browsing task. That removes the conventional phishing-defence layer (user vigilance, link inspection, attachment sandboxing).
The exfiltration target is identity, not data. Drive-by exfiltration of Gmail, Google Drive sharing, and Slack/X password resets point at persistent account takeover rather than one-shot data theft. Once the attacker owns Slack or X, they pivot to corporate SSO via password reset and recovery emails.

What this means for a B2B / production company — and what to do in 30/90 days

Area	What we now know	What it means for a B2B / production company	Action in 30 days	Action in 90 days
Agentic browser governance	Five mainstream agentic browsers are demonstrably hijackable with planted text content; vendors are not patching.	Employees who run Claude, ChatGPT Atlas, or Gemini "agent mode" against their work inbox can leak corporate data via Gmail exfiltration and bypass SSO via password reset flows.	Audit which staff run agentic browsers in "connected to email" mode; ban personal Gmail/Outlook on those browsers.	Roll out a managed browser profile that disables agentic browsing for non-engineering staff.
Identity and SSO	Password resets via Gmail codes work end-to-end from the agent.	A takeover of one personal mailbox can cascade into Slack, X, GitHub, AWS root via reset emails.	Enforce FIDO2 / hardware key as a second factor on all admin and SSO accounts (codes alone are not enough).	Migrate high-privilege password resets away from email to admin-controlled recovery paths; consider passkeys on top-tier SSO.
Vendor / supply chain AI	Rogue NPM package on a rogue CDN bypassed Claude in Chrome sandbox.	AI agentic systems depend on third-party JS bundles and skills/plugins; supply-chain compromises reach the agent as easily as the user.	Review which AI plugins/skills your teams enable; pin versions; require vendor security attestations.	Require SBOM + signed dependencies for any AI plugin or skill you ship internally.
NIS2 / KSC obligations	NIS2 art. 21 (security risk management) and art. 23 (incident reporting) apply to supply-chain and identity compromise.	A PleaseFix-style attack would be a reportable incident if it hits an "important" or "essential" entity. Document it; do not treat as a non-event.	Add "agentic browser compromise" to the incident classification matrix; rehearse the response.	Run a tabletop with IT, OT, legal, and the appointed CSIRT on a PleaseFix-style scenario; map to NIS2 reporting timelines.
Data exfiltration via AI assistants	Gmail inbox, Drive documents, and WhatsApp contacts were exfiltrated in the demos.	Any sensitive data flowing through Gmail/Drive becomes reachable through the agent.	Inventory which sensitive data sits in personal mailboxes vs. corporate-managed mailboxes.	Migrate sensitive workflows off personal mailboxes onto managed mailboxes with DLP.
Detection and monitoring	The agent's actions look like normal user behaviour to a SIEM.	Traditional UEBA cannot distinguish a hijacked agent from a legitimate user.	Add agentic-browser specific telemetry (browser vendor, agent mode flag, Gmail API token usage) to SIEM.	Tune detections for mass Drive sharing, Gmail forwarding rule creation, and out-of-pattern Amazon checkout.

Perspektywa inż. Marcina Białczyka (Founder & Cybersecurity Operator at CHORS.NET)

For the last two years, the public conversation about AI security has been about hallucinations, jailbreaks, and prompt leaks. PleaseFix is the first time I have seen a public demo where the agent is the exfiltration channel and the victim is fully passive. There is no link to click, no attachment to open, no fake login page to spot. The user simply asks Claude to summarise their inbox, and the agent forwards the inbox to the attacker. That changes the threat model for every B2B we talk to.

In our work on NIS2/KSC readiness for production operators, the biggest cultural shift we now have to drive is treating agentic browsers as a separate identity surface, distinct from the user's laptop and from the corporate SSO. The Atlas demo shows that an attacker who controls the agent controls the user's Amazon checkout, which means they control the corporate card on file. The Claude demo shows that they can reset Slack and X passwords via Gmail codes — and most teams still treat Gmail as "personal" rather than "identity recovery." That gap is exactly what PleaseFix exploits.

Two practical pieces of advice that we are already feeding into P3 NIS2/KSC Readiness engagements. First, separate agentic browsing from production identity. Run agentic browsers in a sandboxed profile with no admin tokens, no billing instruments, and no access to corporate recovery mailboxes. Second, kill the password-reset-by-email path on any account that touches production. FIDO2 hardware keys are the only second factor that an agent cannot read out of Gmail. Until vendors patch the architectural problem that OpenAI flagged in January 2026, this is the only mitigation that holds.

I want to be transparent about what CHORS.NET does and does not do here. We do not run a 24/7 SOC, we do not certify NIS2/KSC compliance, and we do not issue independent legal opinions. PleaseFix is a research disclosure, not a breach, so the immediate NIS2 art. 23 reporting clock does not start yet — but if your team is using agentic browsers against a corporate mailbox, the clock is already ticking on the questions you should be asking internally. (Legal interpretation of NIS2 obligations requires consultation with a law firm.)

Frequently asked questions

Q1. Does this affect me if I only use ChatGPT in the browser tab without "agent mode"?

A. No — the demos rely on the agentic features (Atlas in agent mode, Claude in Chrome extension with browser control enabled). Standard chat-in-a-tab is not impacted. The risk surface is the agentic mode that can navigate, click, and fill forms on your behalf.

Q2. Is Google Chrome itself compromised?

A. No. The vulnerability is in the agent layer (Claude in Chrome extension, ChatGPT Atlas browser, Gemini in Chrome agent mode), not in Chrome's renderer. A user running Chrome without any AI agent is not in scope. The supply-chain risk (rogue NPM package) sits in the agent's plugin loader.

Q3. Should I disable agentic browsers company-wide?

A. That is the safest short-term call. If you have a genuine productivity need (e.g. engineering teams running agent-driven code review), isolate them in a sandboxed profile with no production identity, no billing, and no admin tokens. Treat agentic browsing like a privileged access workstation.

Q4. Is this a reportable NIS2 incident?

A. PleaseFix itself is a research disclosure, not an incident at any single entity — so it does not trigger art. 23 reporting as such. However, if your organisation is hit by a PleaseFix-style attack and you are an "important" or "essential" entity, the early-warning obligation (24h) and the incident notification (72h/30d) timeline applies. Legal interpretation requires a law firm.

How CHORS.NET helps

CHORS.NET supports the technical-operational side: passive exposure assessment, configuration verification, evidence packs and NIS2/KSC readiness support. See: Services, About CHORS.NET and Contact.

Boundaries and assumptions

We are not a 24/7 SOC and we do not guarantee detection of every incident.
We do not certify NIS2/KSC compliance and do not issue independent legal opinions.
Findings reflect the public state of PleaseFix research as of 10 August 2026. Vendor responses and patches may shift the picture.
For legal interpretation of NIS2/KSC obligations, CHORS.NET works together with law firms.
This article is informational and technical; it is not legal advice.

Updated: 2026-08-10

Precyzyjna wiedza
o ciemnych systemach.