ClaudeBleed Flaw in Claude Chrome Extension Could Let Malicious Extensions Hijack AI Agent

Anthropic’s Claude Code, Google’s Gemini CLI and OpenAI’s Codex are increasingly embedded in code review and CI/CD workflows, where they can read and modify repositories, execute shell commands and access credentials. That privileged role makes them a new software-supply-chain attack surface. If an agent treats attacker-controlled GitHub issues as trusted context, a prompt injection can cross tool-permission and sandbox boundaries, turning an ordinary public contribution into code execution or secret theft.

At Black Hat USA on Aug. 5, 2026, Novee Security researcher Elad Meged showed that an unprivileged user could plant a malicious GitHub issue that compromised later agent stages. The flaws enabled remote code execution, API-key exfiltration or persistent instruction poisoning. Google rated the Gemini CLI bug CVSS 10.0 and fixed it in version 0.39.1, while Anthropic patched Claude Code in 2.1.163. OpenAI also hardened Codex by separating workflow stages and their writable state.

Anthropic’s Claude desktop app gives users direct access to its generative artificial intelligence tools, but links and local-computer permissions can widen the software’s attack surface. Security researchers identified a vulnerability dubbed PromptFiction that showed how prompt-injection techniques could move beyond a webpage and affect a desktop application, raising risks to private conversations and, in more privileged configurations, files and code stored on a user’s device.

The researchers said an attacker could craft a malicious link that, once clicked, caused Claude’s desktop app to submit concealed instructions automatically and potentially expose conversation data. The impact could become more severe if the application had permission to access local files, creating a path for malicious code to be planted on the computer. Anthropic addressed the flaw in Claude desktop version 1.1.2321, and users are advised to update to the patched release.

Anthropic’s Claude for Chrome extension allows its AI agent to click through websites and carry out browser tasks on a user’s behalf. That convenience also raises the stakes of prompt-injection and permission-abuse attacks. The vulnerability dubbed ClaudeBleed is significant because a compromised agent may gain access to sensitive services connected to the browser session, including Gmail messages and documents stored in Google Docs.

Security firm Manifold said the ClaudeBleed weakness remains incompletely patched. According to its warning, attackers can place scripts on a webpage that simulate click events, prompting the Claude agent to execute tasks automatically without clear user approval and potentially read Gmail and Google Docs content. Security specialists recommend disabling the extension’s no-confirmation automatic execution mode until Anthropic fully addresses the vulnerability.

Anthropic’s Claude Code is a development environment that uses generative AI to help developers read and write code and operate tools. Prompt injection can override a user’s intent if the system mistakes text in a GitHub repository for trusted instructions. Microsoft said the flaw posed a significant risk because CI/CD systems often hold highly privileged credentials such as deployment keys and cloud tokens.

Microsoft security researchers recently disclosed that attackers could hide malicious prompts in GitHub content, inducing Claude Code to execute unintended commands and send CI/CD credentials to an external destination. Anthropic has patched the flaw. Users of version 2.1.128 and earlier are advised to upgrade immediately to reduce the risk of compromise to software supply chains and deployment environments.

Claude Code is Anthropic’s AI development assistant, with direct access to project files, command execution and development environments. A breach of its trust boundaries could therefore put source code and identity credentials at risk. Cybersecurity company Check Point found vulnerabilities in the tool’s project configuration and sandbox mechanisms, highlighting the supply-chain risks that arise when AI coding tools process external content.

Check Point recently disclosed that attackers could plant a malicious configuration file in a project, triggering remote code execution (RCE) and the theft of API keys when a user opened it with Claude Code. Two other sandbox-escape vulnerabilities had existed for nearly six months. Anthropic has patched the flaws, but researchers criticized the company for not proactively disclosing details. Users were advised to upgrade to version 2.0.65 or later.

Accounts for Anthropic's Claude AI have recently been targeted by widespread unauthorized charges, primarily because malicious Chrome extensions stole session tokens. The tokens allowed attackers to bypass the login process and charge credit cards linked to the accounts. The incidents affected users in Taiwan, Canada and the United States, highlighting risks involving browser extensions and payment security.

As of July 20, 2026, reports had not disclosed the exact date of the incidents or the number of victims. Some victims had lost more than NT$10,000, while certain accounts were charged repeatedly. Because Anthropic's payment interface does not allow users to remove credit cards directly and responses from human customer support have been slow, users have had to disable suspicious extensions and contact their banks to dispute the charges and limit their losses.

Anthropic’s Claude Chrome extension can read webpage content and help perform browser tasks, but that capability also creates a risk that the AI may mistake text from an untrusted website for instructions. Cybersecurity firm Koi Security named this type of zero-click prompt-injection technique ShadowPrompt, highlighting a new security risk facing AI assistants with agentic capabilities.

Koi Security recently disclosed that attackers could embed hidden prompts in malicious websites, allowing Claude to be covertly manipulated and diverted from its intended task without the user clicking or entering anything. Anthropic patched the vulnerability by the end of 2025. Public reports have not specified the exact patch date, the number of victims or any related financial losses.