Unpatched Zero-Click Prompt Injection Hits ChatGPT Atlas and Claude Browser Agents

What happened

Why it matters

• ·Enterprise DLP and CASB tools cannot inspect or block prompt injection delivered through external web content such as social media posts or emails, meaning existing perimeter controls offer no protection against these attack vectors, a gap previously identified in CASB and DLP Cannot See Inside AI Prompts.
• ·Because the attack executes through authenticated sessions held by agentic tools, any financial transaction, communication, or data access the agent is authorized to perform becomes reachable by an attacker without credential theft, directly undermining least-privilege and agent credential isolation controls.
• ·With both vulnerabilities remaining unpatched after vendor notification, enterprises cannot wait for a vendor fix and must independently restrict, suspend, or apply compensating controls to these tools; procurement contracts and vendor incident notification requirements should be reviewed to assess whether disclosure timelines create liability exposure.

Governance controls affected

What to do now

• ☐Inventory all current deployments of ChatGPT Atlas and the Claude Chrome extension across the enterprise, including employee-installed browser extensions on managed and unmanaged devices.
• ☐Suspend or restrict agentic browser tool access to authenticated sessions, particularly e-commerce, email, and financial platforms, until patches are confirmed released and validated.
• ☐Review vendor contracts for ChatGPT Atlas and Claude browser tools to determine whether the current disclosure-without-patch timeline triggers notification obligations or vendor SLA remedies.
• ☐Issue updated acceptable use guidance to employees specifying that these tools should not be used in contexts where they hold access to sensitive accounts, financial systems, or regulated data pending remediation.
• ☐Update the organization's prompt injection testing program to include indirect injection via third-party web content, social media, and email as explicit test scenarios under the agentic AI security assessment cadence.

What to watch next

Compliance teams should monitor both Anthropic and OpenAI release notes for confirmed patches addressing these specific vulnerabilities, and should not assume a general model update constitutes remediation without explicit vendor confirmation. The OWASP Top 10 for Large Language Model Applications already classifies indirect prompt injection as a critical risk, and regulators reviewing agentic AI deployments under frameworks such as the EU AI Act may treat unpatched session-hijacking vulnerabilities as evidence of inadequate pre-deployment security assessment. The broader pattern of agentic browser and session attacks, including framework-level flaws across LangChain, AutoGen, and Google ADK, suggests that regulatory guidance on minimum agentic AI security standards is likely to accelerate, and enterprises that have not documented their compensating controls may face audit exposure.