ShadowPrompt: Zero-Click XSS Flaw Hit Claude Extension
Get the Tech newsletter
Daily tech — startups, AI labs, chips, the launches that shape the next decade. Free.
- Koi Security disclosed a vulnerability codenamed ShadowPrompt in Anthropic's Claude Google Chrome Extension that let any website silently inject prompts simply by being visited — no clicks, no permission prompts.
- Oren Yomtov of Koi Security explained the flaw chained an overly permissive origin allowlist (
*.claude.ai) with a DOM-based XSS vulnerability in an Arkose Labs CAPTCHA component hosted ona-cdn.claude[.]ai. - The attack embeds the vulnerable Arkose component in a hidden iframe, sends an XSS payload via postMessage, and the injected script fires a prompt to the Claude extension — Yomtov noted the victim sees nothing.
- Successful exploitation could let attackers steal access tokens, access conversation history with the AI agent, send emails impersonating the victim, and request confidential data.
- Anthropic patched the Chrome extension to version 1.0.41 after responsible disclosure on December 27, 2025, enforcing a strict exact-match origin check requiring
claude[.]ai. - Arkose Labs separately fixed its XSS flaw at its end as of February 19, 2026.
Why it matters: This was a two-vendor trust-boundary failure: Anthropic's subdomain allowlist trusted any `*.claude.ai` origin, and an Arkose Labs CAPTCHA component on that subdomain introduced the XSS. Chaining them turned the Claude extension into an autonomous attack surface capable of stealing tokens and impersonating users in conversations until Anthropic shipped v1.0.41 in late 2025 and Arkose closed its side in February 2026.
