Zenity discloses zero-click hijacking of ChatGPT Atlas and Claude in Chrome

Attackers can hijack benign requests across authenticated sessions via 'intent collision' — a single planted X comment steered Atlas to phish the victim's WhatsApp contacts and purchase items on Amazon via Rufus. Findings were reported to OpenAI and Anthropic but remain unpatched.