A recently discovered vulnerability in the Claude Chrome extension exposes users to potential account hijacking through indirect prompt injection attacks. This flaw allows malicious actors to exploit the AI assistant’s capabilities to access sensitive information and take control of accounts on platforms such as Slack, X (formerly Twitter), and Claude.ai.
Exploitation Methodology
The attack initiates when a user receives a malicious email in their Gmail inbox. If the user requests Claude to summarize recent emails, the assistant may process the attacker-crafted message. Embedded within this email are hidden instructions that can manipulate Claude into executing JavaScript code via its javascript_tool, all without the user’s knowledge.
Previous research has demonstrated how such prompt injection can escalate from triggering simple browser alerts to executing arbitrary code. In this scenario, the focus is on leveraging the vulnerability to perform account takeovers through email-based authentication mechanisms.
Mechanism of Account Takeover
The core issue lies in the javascript_tool operating within the user’s authenticated browser session. This setup allows malicious code to access services where the user is already logged in, including Gmail. An attacker can initiate actions like password resets or verification code requests for other services and then monitor the victim’s inbox for the corresponding emails.
Gmail’s Atom feed endpoint plays a pivotal role in this attack. Since the browser session is authenticated, the injected JavaScript can request recent unread email metadata from Gmail. It can then search for messages containing confirmation codes for services like Slack, password-reset codes for X, or magic links for Claude.ai.
For instance, in the case of Slack, the attack begins by requesting a Slack sign-in code for the victim’s email address. An automated browser process navigates Slack’s login flow and submits the email address. Once Slack sends its confirmation code, the malicious code running in the victim’s browser reads the Gmail Atom feed, extracts the code, and sends it to the attacker. The attacker can then complete the login as the victim.
Similarly, for X, the attack involves initiating a password reset and retrieving the verification code from Gmail. The attacker can then set a new password and obtain an authenticated session cookie. For Claude.ai, the attack exploits its passwordless magic-link process. By reading the magic link from Gmail, the attacker can extract the nonce and submit it to Claude.ai’s authentication endpoints, thereby gaining access to the victim’s account.
Implications and Recommendations
The compromise of a Claude.ai account can have extensive consequences. An attacker might gain access not only to chat history and uploaded files but also to authorized connectors such as Gmail, Google Drive, Calendar, Slack, and GitHub. This research underscores the critical need for robust security measures in AI browser agents, especially those capable of reading untrusted content and executing code within authenticated sessions.
To mitigate such risks, users should exercise caution when granting AI assistants access to sensitive information and be vigilant about the emails they receive. Developers must implement stringent input validation and sandboxing techniques to prevent unauthorized code execution. Additionally, organizations should consider adopting multi-factor authentication and monitoring tools to detect and respond to suspicious activities promptly.
As AI assistants become more integrated into daily workflows, ensuring their security is paramount. This incident serves as a stark reminder of the potential vulnerabilities inherent in AI systems and the importance of proactive security practices to safeguard user data and privacy.
