Agent Incident RegistryAIR
v1 · updated 19 Oct 2026
Disclosed vulnerability

Claude in Chrome: hidden email injection loads a rogue NPM package and takes over Gmail, Drive, Slack and X accounts with zero clicks

AIR-2026-0184 AIR record · 2026-08-anthropic-claude-in-chrome-account-takeover
Open in dashboard About
From the supporting source
Every request automatically operates within the victim's authenticated session and inherits the victim's full identity.labs.zenity.io
The record
Disclosed
2026-08-05
Vendor
Anthropic
Product
Claude in Chrome
Risk domain
Agent behaviour › Unsafe actuation
Also touches
Credential theft, Privilege escalation, Data exfiltration channels, Confused deputy, Supply chain vulnerabilities
System type
Generative model
Who acted
Agent acted — the agent loaded the rogue package and took over the live accounts
Attack surface
Browser agent
Autonomy level
Semi-autonomous
Initial vector
Indirect prompt injection email
Impact type
Account takeover, Data exfiltration, Credential theft, Unauthorized action
Confidence
High
Submitted by
EAI Internal
Crosswalk
OWASP Agentic Top 10 (2026)
ASI01 – Agent Goal Hijack
MITRE ATLAS
AML.T0048 – External Harms
NIST AI RMF
MEASURE 2.6; MANAGE 1.3
EU AI Act
Annex III §1(c)
ISO/IEC
TR 24028; 24029-1; 23894
AIUC-1
C. Safety
Scope
agent misuse
Mitigation
Require confirmation for destructive actions; Implement dry-run modes; Use layered safety controls.
Taxonomy
Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Claude in Chrome users who ask it to summarize their inbox
Capability abused
email_summarizationjavascript_execution_in_page_contextauthenticated_cookie_reusefile_sharingpassword_reset_code_readauthenticated_browsingscript_executioncross_site_actionsession_accessjavascript_executionauthenticated_session_cookiesgmail_feed_access
Defense & remediation
Recorded defense
Claude in Chrome script-execution safety checks and site permissions
Guardrail kinds
Permission scope
Guardrail outcome
Silent
Fix shipped
none - Anthropic closed the 2025-12-27 report as Informative on 2026-01-27 and the 2026-01-12 report as a HackerOne duplicate; unpatched at publication
Taxonomy & references
OWASP ASI01 Agent Goal HijackOWASP ASI06 Memory & Context PoisoningOWASP ASI04 Agentic Supply Chain VulnerabilitiesOWASP ASI03 Identity and Privilege Abusezero_clickrogue_cdnnpm_typosquat_style_importsession_cookie_abuseotp_interceptionunpatchedvendor_disputeagentic_browserxss_to_agent_escalationaccount_takeovermagic_link_theftbrowser_agent
Curator notes
Zenity Labs, Black Hat USA 2026, part of the 'PleaseFix' class. Chain: hidden injection inside a Gmail message fires when the user asks Claude to summarize email; the injection gets Claude to import JavaScript from an attacker CDN impersonating esm.sh (blocking direct script execution is bypassed by making it look like a benign package import); the code then runs in page context with the victim's cookies. Demonstrated: full inbox exfiltration via Atom feed queries, silent sharing of all Google Drive files to the attacker, and takeover of Slack, X and claude.ai itself by reading password-reset codes. DISPUTE: Anthropic deemed it ineligible for its VDP. Also reported under the titles: 'Claude in Chrome: indirect prompt injection in an email escalates to account takeover on Slack, X and Claude.ai'; 'Account takeover via Claude in Chrome: email prompt injection steals magic-link tokens through javascript_tool'.
Supporting sources
Cite as
Enkrypt AI. "Claude in Chrome: hidden email injection loads a rogue NPM package and takes over Gmail, Drive, Slack and X accounts with zero clicks". AIR, AIR-2026-0184. https://agentincident.vercel.app/i/AIR-2026-0184/ (accessed 2026-10-19).