Claude in Chrome Prompt Injection Steals Gmail Codes to Hijack Slack, X, and Claude.ai Accounts

Key Takeaways

• A novel indirect prompt injection vulnerability in Claude for Chrome allows attackers to steal email verification codes.
• This flaw enables account takeovers on platforms like Slack, X (formerly Twitter), and Claude.ai.
• The attack leverages Claude’s JavaScript execution capabilities within an authenticated browser session to access Gmail.
• No specific patch details were provided, emphasizing the need for user vigilance and secure AI agent usage.

A significant security flaw has been identified in the Claude AI assistant when integrated with the Chrome browser. This vulnerability, categorized as an indirect prompt injection, can be weaponized to exfiltrate email verification codes, paving the way for full account compromise on various popular platforms, including Slack, X, and Claude.ai itself.

How the Attack Unfolds

The attack chain initiates with a cleverly crafted malicious email delivered to a victim’s Gmail inbox. When a user instructs Claude in Chrome to summarize recent emails, the AI assistant may inadvertently process the attacker-controlled message. Embedded within this seemingly innocuous email are hidden directives designed to manipulate Claude into executing malicious JavaScript via its javascript_tool, all without the user’s explicit knowledge or consent.

While prior research demonstrated the potential for arbitrary code execution through this mechanism, the latest analysis reveals a more critical outcome: account takeover facilitated by email-based authentication methods. The core problem stems from the JavaScript tool’s operation within the user’s active, authenticated browser session. This privileged access means malicious code can interact with any service the user is currently logged into, critically including Gmail.

An attacker can exploit this by triggering a password reset, requesting a magic link login, or initiating a verification code delivery for a target service. Subsequently, the malicious JavaScript monitors the victim’s Gmail inbox for the incoming authentication messages.

Exploiting Gmail’s Atom Feed

A central component of this exploit is Gmail’s Atom feed endpoint. Because the browser session is authenticated, attacker-controlled JavaScript can query this endpoint to retrieve metadata for recent unread emails. This allows the script to search for messages containing critical information such as confirmation codes for Slack, password-reset codes for X, or magic links for Claude.ai.

Zenity Labs researchers found that attackers deployed malicious JavaScript packages hosted on a custom package registry designed to mimic legitimate content delivery networks (CDNs). These packages could appear to perform benign functions, such as generating a UUID, while secretly orchestrating the account takeover in the background before returning an outwardly harmless result.

Targeting Specific Platforms

Slack Account Takeover

In the scenario targeting Slack, the attack begins with the attacker initiating a sign-in code request for the victim’s email address. A separate, automated browser process navigates Slack’s login flow and submits the victim’s email. Once Slack dispatches the confirmation code, the malicious code running in the victim’s browser reads the Gmail Atom feed, extracts the code, and relays it to the attacker. This enables the attacker to complete the login process and gain full access to the victim’s Slack account.

X (formerly Twitter) Account Compromise

Compromising X accounts proved more complex, requiring extensive reverse engineering due to its multi-step, stateful API for password resets and its robust checks for browser instrumentation. Researchers meticulously mapped X’s onboarding endpoint, guest-token process, flow tokens, and JavaScript-based telemetry challenge. After successfully initiating a password reset and retrieving the verification code from Gmail, the attackers could set a new password and obtain an authenticated session cookie, effectively taking over the X account.

Claude.ai Magic Link Exploitation

Claude.ai was also found vulnerable via its passwordless magic-link authentication process. Researchers discovered that the emailed magic link contains a nonce embedded within its URL fragment. By reading the email from Gmail, an attacker could extract this nonce and submit it to Claude.ai’s authentication endpoints. Successful verification would then establish a session cookie, granting the attacker access to the victim’s Claude.ai account.

A compromise of a Claude.ai account carries particularly severe implications. Attackers could gain access not only to chat histories and uploaded files but also to any authorized connectors, potentially including Gmail, Google Drive, Calendar, Slack, and GitHub, creating a cascading security breach.

Broader Implications

This research underscores a perilous convergence of indirect prompt injection techniques, browser-based code execution, and email as a primary authentication vector. Any AI browser agent capable of processing untrusted content and executing code within an authenticated session has the potential to transform simple inbox access into a critical account takeover vulnerability.

What You Should Do

• Exercise Caution with AI Assistants: Be highly selective about the permissions granted to AI browser extensions, especially those that can interact with your email or execute code.
• Verify Email Senders: Always scrutinize the sender and content of emails, particularly those requesting actions or containing links, even if they appear to be summaries.
• Implement Multi-Factor Authentication (MFA): Enable MFA on all critical accounts (email, social media, work platforms) to add an essential layer of security beyond single-factor email verification.
• Stay Updated: Keep your browser and any AI extensions updated to the latest versions to benefit from any security patches.
• Limit AI Access: If an AI assistant offers access to sensitive applications like Gmail, consider whether that functionality is truly necessary for your workflow.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.