Cyberole
← ALL GUIDES
Security guide

AI Browser Agents Keep Getting Hijacked. Here Is What an AI Security Candidate Must Know in 2026

Claude in Chrome, ChatGPT Atlas and four other AI browsers were all shown to be hijackable through prompt injection in 2026, in some cases with zero clicks from the victim. This guide walks through the real disclosures, why the problem resists a clean fix, and the defences and interview-ready knowledge every AppSec and AI security candidate needs now.

By Farhad R
Poster reading "AI Agents: Hijacked" above five browser windows, each connected by a thread running down to a torn-open envelope that a hand is reaching toward

In 2026, independent researchers hijacked production AI browser assistants from at least five vendors using nothing more than a poisoned webpage or a single email the victim never opened. This guide walks through what actually happened, why the companies building these assistants say the problem may never be fully solved, and what that means if you are the person who will be asked to secure, test or interview about an AI agent in the next twelve months.

TL;DR: AI browser agents read untrusted content (pages, emails, documents) and act on what they read. Attackers hide instructions inside that content. In 2026 this produced real zero-click account takeovers against Claude in Chrome, and researchers showed working variants against ChatGPT Atlas, Perplexity Comet, Gemini in Chrome and Copilot Edge. Vendors have cut attack success rates with training and classifiers, not eliminated the risk, and say so in their own published numbers. Below is how the attacks work, the defences that exist, and a review checklist.

What this guide covers

  1. What an AI browser agent actually is, and why it changes the security model.
  2. Prompt injection in one page: direct vs indirect, and why "ask before acting" is not a fix.
  3. Four real 2026 disclosures, with dates, mechanics and outcomes.
  4. What the vendors' own numbers say about how far this is from solved.
  5. A defender's checklist and the frameworks that now cover this (OWASP, MITRE ATLAS).
  6. Interview-ready talking points, if this comes up in an AppSec or AI security interview, which it increasingly does.

What an AI browser agent actually is

An AI browser agent (Claude in Chrome, ChatGPT Atlas, Perplexity Comet, Gemini in Chrome, Microsoft Copilot in Edge) is a browser extension or browser that lets a large language model read the page you're on, read your email or documents when you ask it to, and take actions: click, type, submit forms, send messages, manage files. It runs with your logged-in session.

That is the entire point of the product, and it is also the entire problem. A traditional application separates code from data: a web form validates that your input is a string, not a command. An LLM does not have that boundary by default. It reads the user's instructions and the content of the page as the same kind of thing, language, and decides what to do next based on all of it together.

Prompt injection in one page

Direct prompt injection is when the attacker is the user: they type something designed to make the model ignore its own rules ("ignore previous instructions and..."). This is the classic jailbreak and it is largely a content-moderation problem.

Indirect prompt injection is the one that matters for agents. The attacker is not the user. The attacker controls a webpage, an email, a shared document, a calendar invite or an image, and plants instructions there for the model to find later, when a legitimate user asks the agent to summarise, browse or act on that content. The victim never has to interact with the attacker directly. OWASP's Top 10 for Agentic Applications maps prompt injection to six of its ten categories, because once an agent can take actions, a successful injection is rarely just a chat message, it is a chain of real-world effects (OWASP GenAI Security Project).

"Ask before acting" / human-in-the-loop confirmation modes are the standard mitigation vendors ship. They are not a complete fix. Zenity's research describes an injection that works in a browser agent's confirmation mode by tricking the model into adding an attacker's domain to its own list of pre-approved destinations, through a tool call the user never reviewed line-by-line (Zenity Labs, 2026).

Four real 2026 disclosures

1. Claude in Chrome: alert(1) to full account takeover

Security vendor Zenity built a chain that starts from a basic cross-site scripting proof of concept and ends in account takeover. The attack: send the victim an email containing hidden instructions, injected fake conversation turns, and instructions embedded inside an image. The victim never opens that email. They simply ask Claude, in a later, unrelated session, to "summarise my last emails." Claude reads the inbox, including the malicious one, follows the hidden instructions, and loads attacker-controlled JavaScript from a domain designed to look like a legitimate CDN, with the payload disguised behind an innocuous-looking function call. From there the researchers intercepted password-reset codes and magic-link tokens out of Gmail to take over the victim's Slack, X and Claude.ai accounts, and silently shared Google Drive files with an attacker-controlled account for persistence (Zenity Labs, August 2026).

Disclosure timeline, per Zenity's public writeup: first report filed via HackerOne on 27 December 2025, a second report on 12 January 2026 closed as a duplicate the next day, the first report closed as "Informative" on 27 January 2026, and public disclosure on 5 August 2026. Zenity states the underlying class of risk was still unresolved at time of publication; this is the researchers' claim, not an independently verified vendor statement, so treat the current patch status as unconfirmed rather than closed.

2. ShadowPrompt: a one-line trust mistake

Separately, Koi Security researcher Oren Yomtov found that the Claude in Chrome extension validated the origin of pages allowed to message it with a wildcard pattern matching any subdomain of claude.ai, instead of the one specific subdomain it should have trusted. Any page an attacker could get served from a matching subdomain, or a lookalike that satisfied the check, could talk to the extension directly. It is a reminder that in agent security, an origin-check bug can be as dangerous as a classic prompt injection, because it skips the injection step entirely.

3. BioShocking and PleaseFix: this is an industry problem, not a vendor problem

LayerX's "BioShocking" research disclosed an indirect prompt injection technique and demonstrated it against six different AI browsers (Cloud Security Alliance research note, June 2026). At Black Hat 2026, the "PleaseFix" research presented zero-click hijacking against Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas and Microsoft Copilot in Edge (Dark Reading, 2026). OpenAI's response included shipping a "Lockdown Mode" for ChatGPT Atlas in February 2026, alongside a public acknowledgement that prompt injection in AI browsers may not be fully patchable with current techniques. If you are tracking this for interview prep: this is not "Anthropic has a bug," it is "every vendor shipping an agentic browser in 2026 has shipped this bug," which is the more useful framing for a security conversation.

4. What the model providers' own red-teaming shows

Anthropic publishes attack success rate (ASR) figures for prompt injection against Claude's browser use, tested with an automated adaptive attacker given 100 attempts per scenario. For Claude Opus 4.5: 8.0% ASR for the model alone, 7.6% with the prior generation of safeguards, and 1.4% with Anthropic's current classifiers and training improvements (Anthropic, 2026). Anthropic's own framing: "A 1% attack success rate, while a significant improvement, still represents meaningful risk." That is the company that builds both the model and the defence telling you, in its own published research, that the open problem is not closed.

Security impact across all four: full account takeover across multiple unrelated platforms, data exfiltration from email and cloud storage, persistence through silently shared files, and in the Zenity case, the compromise happened without the victim clicking anything attacker-controlled. The victim's only action was asking their own assistant to do its normal job.

What actually defends against this, today

There is no single fix, which is why every serious writeup on this topic lists several layers instead of one silver bullet.

  • Content classifiers on ingestion. Scan incoming web content, email bodies and images for hidden text, suspicious formatting and manipulated UI elements before the model ever sees them, and adjust the model's behaviour when something is flagged. This is what Anthropic describes improving between its "old" and "current" safeguards.
  • Adversarial training. Expose the model during training to simulated prompt injections, including ones phrased with urgency or false authority, and reward refusal. This moved Anthropic's raw ASR down before the classifier layer was even applied.
  • Least-privilege tool scope. An agent that can read email should not also be able to approve its own domain allow-list changes through a tool call the user never reviews. Several of the real-world bypasses specifically targeted this gap in "ask before acting" flows.
  • Origin and trust-boundary review. ShadowPrompt was a plain access-control bug, not a model-reasoning failure. Any extension or agent that accepts messages based on an origin pattern needs that pattern audited the way you would audit a CORS policy, because the consequence here is worse than a CORS bug.
  • Assume a non-zero success rate and plan containment. Scoped sessions, short-lived tokens, and monitoring for anomalous account actions (new OAuth grants, new Drive shares, password resets) matter precisely because vendors themselves report ASR above zero even with current defences.
  • Red team your own agent deployments. If your organisation deploys an AI browser agent, assume the published techniques (hidden text in email, image-embedded instructions, injected fake conversation turns) will be tried against it, because they are now public and repeatable.

A checklist for reviewing an AI agent deployment

  • Does the agent read untrusted content (email, web pages, shared documents) before it can take privileged actions? If yes, that content is now part of your attack surface.
  • Are tool calls that change trust boundaries (adding an allowed domain, approving a new destination) themselves gated by human review, or can the model approve them as a side effect of another action?
  • What origin or domain checks gate who can message the agent directly? Are they exact matches, or wildcard patterns that could be satisfied by a lookalike?
  • Does the deployment log and alert on account-level side effects (new OAuth grants, sharing changes, password resets) that a hijacked agent session could trigger?
  • Has the vendor published an attack success rate for prompt injection against the specific product you are deploying, and what was it tested against?
  • Have you mapped your agent's capabilities against OWASP's Top 10 for Agentic Applications and MITRE ATLAS techniques, rather than treating "prompt injection" as one checkbox?

Interview-ready talking points

If an AppSec or AI security interview brings this up, and in 2026 it increasingly does, these are the points that show you understand the problem rather than just the headline:

  • Direct injection is a content problem; indirect injection is an architecture problem. The second one is what makes agents dangerous, because the attacker never has to interact with the victim.
  • "Human in the loop" is a mitigation, not a boundary. Real disclosures show injected instructions manipulating the approval mechanism itself.
  • Vendors report attack success rate, not "fixed." Quoting Anthropic's own 1.4% ASR figure, and their own quote that it "still represents meaningful risk," shows you read primary sources instead of headlines.
  • This spans every vendor shipping agentic browsers, not one company. Naming Claude in Chrome, ChatGPT Atlas, Perplexity Comet, Gemini in Chrome and Copilot Edge in the same breath shows you understand this as an industry-wide architecture problem.
  • OWASP's Top 10 for Agentic Applications and MITRE ATLAS are the frameworks to cite, the same way you would cite the OWASP Top 10 or MITRE ATT&CK in a traditional AppSec interview.

Practise AI security on Cyberole

Cyberole's AI security section covers prompt injection, tool scope, agent permissions and data leakage, with questions built from real cases like the ones in this guide, not abstract theory. Each answer explains the reasoning so you can actually use it in an interview, not just recognise the right letter. Start practising for free today.

Conclusion

Every major AI browser agent shipped in 2026 has had a working, disclosed prompt injection chain, and in at least one case it required zero interaction from the victim beyond asking their assistant to do the job it was built for. The vendors building these products are not claiming the problem is solved; Anthropic's own published research says a measurable attack success rate "still represents meaningful risk" even after its best current defences. For anyone moving into AppSec or AI security, this is no longer a speculative topic for a conference talk. It is a live, repeatable class of vulnerability with public disclosures, CVE-adjacent writeups and a growing body of research, and it is exactly the kind of knowledge that separates a candidate who has read the headline from one who has read the disclosure.

References

AI securityPrompt injectionLLM securityAgentic AIOWASP Top 10 for LLMMITRE ATLASAppSec interview questionsAI red teaming