Zenity researchers have reported a zero-click browser hacking technique targeting AI models, specifically Claude and ChatGPT Atlas. The method reportedly leverages emails and X posts to compromise user sessions without requiring direct interaction from the victim. The researchers claim to have disclosed these findings to Anthropic and OpenAI in late 2025 and early 2026, respectively, but the vulnerabilities remain unpatched.
The reported attack vector, described as "zero-click," suggests that merely viewing a malicious email or X post could initiate a compromise. This typically implies exploitation of client-side vulnerabilities within the browser or the application rendering the content. In this context, it could involve flaws in how the web interfaces for Claude or ChatGPT Atlas process embedded content, scripts, or other elements when displayed within a standard web browser. The "Atlas" designation for ChatGPT might refer to a specific version, interface, or underlying architecture of the OpenAI model.
The mechanism likely involves a form of cross-site scripting (XSS), cross-site request forgery (CSRF), or a similar client-side vulnerability that allows an attacker to execute arbitrary code or manipulate user sessions. For AI models accessed via web browsers, this could mean an attacker gaining unauthorized access to a user's session, potentially allowing them to view conversation history, submit queries on behalf of the user, or even manipulate model behavior within the compromised session. The "zero-click" aspect is particularly concerning as it lowers the bar for successful exploitation, requiring no user interaction beyond simply opening or viewing the malicious content.
The affected products are specifically named as Claude, developed by Anthropic, and ChatGPT Atlas, from OpenAI. Both are prominent large language models (LLMs) that offer conversational AI capabilities through web-based interfaces. The scope of potential impact would extend to users accessing these services via web browsers, where the reported vulnerabilities are said to reside.
Mitigation for this class of issue generally involves robust input validation, output encoding, and strict content security policies (CSPs) on the server side to prevent the injection and execution of malicious code. For users, keeping web browsers updated to the latest versions, employing browser security extensions, and exercising caution with unsolicited emails and links from unknown sources are standard recommendations, though a zero-click vulnerability inherently bypasses some of these user-centric defenses.
The report highlights the evolving threat landscape surrounding AI applications, particularly those accessed through web interfaces. As AI models become more integrated into daily workflows, the security of their access mechanisms becomes paramount. The persistence of unpatched vulnerabilities, even after disclosure, underscores the ongoing challenge for vendors to address security flaws promptly and for users to remain vigilant against sophisticated, low-interaction attack methods.
