Zero-Click Prompt Injection Hijacks Claude and ChatGPT Atlas: Detection and Containment Guide for AI Browsers

---
title: AI Agent Process Spawning Command Interpreter or Scripting Engine
id: 3f9c2a71-8b4e-4d5a-9c1e-7f2a3b4d5e6f
status: experimental
description: Detects agentic AI browser or assistant processes (ChatGPT Atlas, Claude, Comet) spawning command shells, scripting engines, or download utilities. Indirect prompt injection that reaches computer-use or local tool execution frequently manifests as the agent process launching cmd, PowerShell, curl, or osascript. Legitimate agent operation does not normally require shell invocation on the endpoint.
references:
  - https://www.securityweek.com/zero-click-ai-browser-hacking-claude-and-chatgpt-atlas-hijacked-via-emails-x-posts/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/29
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\atlas.exe'
      - '\chatgpt atlas.exe'
      - '\claude.exe'
      - '\comet.exe'
      - '\openai.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\curl.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - AI-assisted developer workflows where the user has explicitly enabled local tool/terminal execution features
  - First-run telemetry or update helpers bundled with the desktop client (verify signature and frequency)
level: high
---
title: AI Agent Process Accessing Browser Credential or Session Stores
id: 8e4b1d62-3a7f-4c8b-b2d9-5e6f7a8b9c0d
status: experimental
description: Detects agentic AI browser or assistant processes reading browser credential databases, cookie stores, or SSH key material. A hijacked agent instructed to exfiltrate secrets commonly targets Chrome Login Data, cookie stores, and .ssh directories. The agent application has no legitimate reason to read another browser's credential store directly.
references:
  - https://www.securityweek.com/zero-click-ai-browser-hacking-claude-and-chatgpt-atlas-hijacked-via-emails-x-posts/
  - https://attack.mitre.org/techniques/T1555/
  - https://attack.mitre.org/techniques/T1539/
author: Security Arsenal
date: 2026/01/29
tags:
  - attack.credential_access
  - attack.t1555.003
  - attack.t1539
logsource:
  category: file_event
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\atlas.exe'
      - '\chatgpt atlas.exe'
      - '\claude.exe'
      - '\comet.exe'
      - '\openai.exe'
  selection_target:
    TargetFilename|contains:
      - '\Google\Chrome\User Data\Default\Login Data'
      - '\Google\Chrome\User Data\Default\Cookies'
      - '\Google\Chrome\User Data\Default\Network\Cookies'
      - '\Microsoft\Edge\User Data\Default\Login Data'
      - '\BraveSoftware\Brave-Browser\User Data\'
      - '\.ssh\id_rsa'
      - '\.ssh\id_ed25519'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
  condition: selection_image and selection_target
falsepositives:
  - Browser-import or migration workflows during first-run setup (should be one-time, correlatable with install events)
level: high
---
title: AI Agent Process Network Egress to Non-Vendor Infrastructure
id: 5c2d8f94-1e6a-4b3c-a7d2-9f0e1a2b3c4d
status: experimental
description: Detects agentic AI browser processes initiating outbound connections to destinations outside the vendor's known service domains. Indirect prompt injection exfiltrates data by having the agent browse to or POST to attacker-controlled hosts. Baseline vendor endpoints for your tenant first, then alert on deviations. Most effective as a high-signal hunt paired with DNS and proxy telemetry rather than a blanket block rule.
references:
  - https://www.securityweek.com/zero-click-ai-browser-hacking-claude-and-chatgpt-atlas-hijacked-via-emails-x-posts/
  - https://attack.mitre.org/techniques/T1041/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/01/29
tags:
  - attack.exfiltration
  - attack.t1041
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\atlas.exe'
      - '\chatgpt atlas.exe'
      - '\claude.exe'
      - '\comet.exe'
      - '\openai.exe'
  selection_initiated:
    Initiated: 'true'
  filter_vendor:
    DestinationHostname|endswith:
      - '.openai.com'
      - '.chatgpt.com'
      - '.oaistatic.com'
      - '.oaiusercontent.com'
      - '.anthropic.com'
      - '.claude.ai'
      - '.perplexity.ai'
  filter_cdn:
    DestinationHostname|endswith:
      - '.cloudflare.com'
      - '.googleapis.com'
      - '.azureedge.net'
  condition: selection_image and selection_initiated and not 1 of filter_*
falsepositives:
  - Agentic browsing to arbitrary websites IS the product function for Atlas/Comet — this rule is only viable for assistant processes with browsing disabled, or in environments where agents are policy-restricted to approved domains
  - Redirect chains and embedded third-party content on legitimate pages
level: medium

// Hunt: AI agent processes spawning shells, script engines, or download utilities
// Covers Windows endpoints via Defender for Endpoint process telemetry
let AgentProcesses = dynamic(["atlas.exe", "chatgpt atlas.exe", "claude.exe", "comet.exe", "openai.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe",
    "mshta.exe", "curl.exe", "certutil.exe", "bitsadmin.exe", "rundll32.exe", "regsvr32.exe"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (AgentProcesses)
| where FileName in~ (SuspiciousChildren)
| project TimeGenerated, DeviceName, AccountName,
    AgentProcess = InitiatingProcessFileName,
    AgentCommandLine = InitiatingProcessCommandLine,
    ChildProcess = FileName,
    ChildCommandLine = ProcessCommandLine,
    SHA256, ReportId
| sort by TimeGenerated desc;

// Hunt: AI agent processes connecting to rare / first-seen destinations
// Flags agent egress to destinations not seen from that device in the prior 30 days
let AgentProcesses = dynamic(["atlas.exe", "chatgpt atlas.exe", "claude.exe", "comet.exe", "openai.exe"]);
let KnownBaseline =
    DeviceNetworkEvents
    | where TimeGenerated between (ago(44d) .. ago(14d))
    | where InitiatingProcessFileName in~ (AgentProcesses)
    | summarize by RemoteUrl, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ (AgentProcesses)
| where RemoteUrl !has_any ("openai.com", "chatgpt.com", "anthropic.com", "claude.ai", "perplexity.ai")
| where RemoteUrl !in (KnownBaseline) and RemoteIP !in (KnownBaseline)
| summarize FirstSeen = min(TimeGenerated), ConnectionCount = count(),
    Ports = make_set(RemotePort), IPs = make_set(RemoteIP)
    by DeviceName, InitiatingProcessFileName, RemoteUrl
| sort by ConnectionCount desc;

-- Hunt for child processes spawned by agentic AI browsers/assistants
-- and identify unsigned or script-based descendants indicative of
-- prompt-injection-driven local execution.
LET agents <= SELECT Pid, Name, Exe
FROM pslist()
WHERE Name =~ '(?i)(atlas|claude|comet|openai|chatgpt)'

SELECT a.Name AS AgentName,
       a.Pid AS AgentPid,
       a.Exe AS AgentPath,
       p.Pid AS ChildPid,
       p.Name AS ChildName,
       p.Exe AS ChildPath,
       p.CommandLine AS ChildCommandLine,
       p.Username AS ChildUser,
       p.CreateTime AS ChildCreated
FROM pslist() AS p
JOIN agents AS a ON p.Ppid = a.Pid
WHERE p.Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript|mshta|curl|certutil|bitsadmin|rundll32|osascript|bash|sh)'

# Security Arsenal - Agentic AI Browser Exposure Audit & Containment
# Run elevated. Test in a pilot OU before broad enforcement.
# -Mode Audit   : inventory only, no changes
# -Mode Enforce : applies outbound restriction rules for AI agent processes
param([ValidateSet("Audit","Enforce")][string]$Mode = "Audit")

$AgentPaths = @(
    "$env:LOCALAPPDATA\Programs\ChatGPT Atlas\atlas.exe",
    "$env:LOCALAPPDATA\Programs\Claude\claude.exe",
    "$env:LOCALAPPDATA\Programs\Comet\comet.exe",
    "$env:ProgramFiles\OpenAI\ChatGPT Atlas\atlas.exe"
)

# --- Step 1: Inventory installed agentic AI browsers ---
Write-Output "=== Agentic AI Browser Inventory ==="
$found = @()
foreach ($p in $AgentPaths) {
    if (Test-Path $p) {
        $ver = (Get-Item $p).VersionInfo.ProductVersion
        $found += $p
        Write-Output ("FOUND: {0}  Version: {1}" -f $p, $ver)
    }
}
# Broader sweep for non-standard install locations
Get-ChildItem "$env:LOCALAPPDATA\Programs","$env:ProgramFiles" -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match '(?i)(atlas|claude|comet|openai)' } |
    ForEach-Object { Write-Output ("DIR:   {0}" -f $_.FullName) }

# --- Step 2: Flag running agent processes with active network sessions ---
Write-Output "`n=== Active Agent Processes with Network Sessions ==="
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc -and $proc.ProcessName -match '(?i)(atlas|claude|comet|openai)') {
            Write-Output ("{0} (PID {1}) -> {2}:{3}" -f $proc.ProcessName, $_.OwningProcess, $_.RemoteAddress, $_.RemotePort)
        }
    }

# --- Step 3 (Enforce only): Restrict agent process outbound traffic ---
# Default-deny egress for agent executables; re-allow ONLY vendor service
# endpoints via companion DNS/proxy policy. Reversible via -Remove switch logic.
if ($Mode -eq "Enforce") {
    foreach ($p in $found) {
        $ruleName = "SecArsenal-AIAgent-EgressBlock - " + (Split-Path $p -Leaf)
        if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
            New-NetFirewallRule -DisplayName $ruleName -Direction Outbound `
                -Program $p -Action Block -Profile Any `
                -Description "Blocks direct egress for agentic AI browser pending prompt-injection remediation (Zenity, Jan 2026). Vendor access routed via inspected proxy." | Out-Null
            Write-Output ("APPLIED: {0}" -f $ruleName)
        }
    }
    Write-Output "`nEnforcement applied. Route agent traffic through an inspected proxy with an" 
    Write-Output "allowlist for openai.com / chatgpt.com / anthropic.com / claude.ai only."
    Write-Output "Rollback: Get-NetFirewallRule -DisplayName 'SecArsenal-AIAgent-*' | Remove-NetFirewallRule"
}

# --- Step 4: Report local tool-execution surfaces (MCP config, computer-use) ---
Write-Output "`n=== Local Tool Integration Config (MCP / computer-use) ==="
$mcpPaths = @(
    "$env:APPDATA\Claude\claude_desktop_config.json",
    "$env:APPDATA\Anthropic\Claude\claude_desktop_config.json"
)
foreach ($m in $mcpPaths) {
    if (Test-Path $m) {
        Write-Output ("MCP CONFIG: {0}" -f $m)
        Get-Content $m | Select-String -Pattern 'command|args|url' | ForEach-Object { Write-Output ("  {0}" -f $_.Line.Trim()) }
    }
}