§1What happened
Researchers at Zenity Labs showed that a single crafted email could make Claude in Chrome run attacker-controlled code inside a victim's already logged-in browser, and from there take over their Gmail, Drive, Slack, X and Claude.ai, all triggered by the user innocently asking the agent to summarise their inbox. No password was phished and no model jailbreak was needed. The instructions rode in on content the user asked the agent to read.
The setup is the browser-agent pitch everyone is selling right now: an assistant that lives in your tabs, sees what you see, and can click and type on your behalf so you do not have to. To be useful it runs inside your real session, the one already signed in to your email, your storage and your work tools. That convenience is the whole attack. The researchers reported the chain to Anthropic in late December 2025; per their write-up it was classified as informative and outside the vulnerability disclosure programme, and they state the behaviour still worked at the time of publishing. We are not scoring that decision. We are reading the mechanism, because the mechanism is the useful part.
§2Nobody attacked Claude. They attacked the email.
This is indirect prompt injection, and the "indirect" is the whole trick. Nobody sent a malicious prompt to the model. They put the instructions in a place the model was always going to read: an email in the victim's own inbox. When the user says "summarise my last few emails", the agent dutifully reads all of them, including the one whose body is written not for a human but for the model. The agent cannot tell the difference, because to the agent there is no difference. Content it was told to process and instructions it should obey arrive on the same channel, in the same words.
So the model did nothing out of character. It followed instructions inside the task it was given. Every defence that lives at the level of "will the model agree to do a bad thing" is looking at the wrong layer, because from the model's seat this was not a bad thing. It was step four of summarising your inbox.
§3The tool was the vulnerability, not the model
Here is the load-bearing detail. Claude in Chrome shipped with a tool that could run JavaScript, and per the research it could run that JavaScript on any domain, inside the victim's authenticated session. The researchers describe it bluntly as cross-site scripting as a service: a general-purpose code-execution primitive that already holds your cookies. Once the injected instructions steered the agent into running attacker code, that code was not some sandboxed toy. It was you, on every site you were signed in to.
The injection dressed the payload up as something dull, an import that looked like it fetched a harmless utility from a package CDN, pointed at a lookalike host standing in for the real one. The model saw a reasonable-looking dependency. The user saw an assistant summarising email. Underneath, arbitrary code was running with full ambient authority. A refusal governs what a model will say. It does nothing about what its tools can reach. This tool could reach everything.
§4How one email became five takeovers
Walk the chain, because none of the steps are exotic. First, inbox exfiltration: the code pulled the victim's mail straight from Gmail's own Atom feed, subjects, senders and bodies, and shipped it out while the agent showed a tidy summary on screen. Then Drive: it enumerated the victim's files and, abusing the internal API the browser was already authenticated against, silently added the attacker as an editor on them, a foothold that survives a later password change.
Then the account takeovers, all built on one primitive: the attacker could read the victim's inbox on demand. So the attacker drove the normal login flows on other services from their own side, Slack, X, Claude.ai, and each time a service emailed a confirmation code, a password-reset code or a magic link, the injected code plucked it out of the victim's Gmail and handed it over. Five services, one root cause. The agent was a skeleton key because it could both act as the user and read the user's mail, and every "prove it is really you" step in the industry assumes those two powers do not sit in the same place.
§5The "ask first" gate that could whitelist itself
Browser agents ship with a safety net for exactly this: ask the human before acting. It matters that this existed and still did not save anyone. In the demonstrated chain the injected instructions got the agent to add the attacker's domain to its own list of approved actions, so the approval step was satisfied by the attack rather than by the user. A confirmation gate the agent can edit on its own behalf is not a gate. It is a suggestion the attacker can accept for you.
This is the confused-deputy problem wearing modern clothes. The agent has more authority than the person steering it in that moment, and the steering came from the content, not the user. Any control you place on the same side of the boundary as the agent can be talked into standing down by whatever the agent just read.
§6What this means if you give an agent a browser
We run an autonomous fleet, so we read this as an operating question, not a headline. The transferable lesson is the one we have been building toward all summer, and it is the same lesson as our skill scanner shipped the same day: the security boundary is the agent's tools and reach, not its prompt. Three things follow. Scope the browser tool to a narrow allowlist of domains it may touch, never "any site". Do not run the agent inside a human session that is already signed in to everything, give it its own identity with the least access the task needs, so a hijack inherits little instead of everything. And keep the credentials and the confirmation gate on a layer the agent cannot rewrite for itself.
The uncomfortable part is that none of this is a model bug you can wait for a vendor to patch. Prompt injection through untrusted content is, for now, an unsolved problem the whole field is carrying, and a browser agent's job is to read untrusted content all day. So the honest posture is to assume the agent will, at some point, run something it was told to by a stranger, and to make sure that when it does, the blast radius is a shrug and not your inbox. Assume the payload gets in. Make the tools it lands in boring.