2025-11 · 2025-Q4
Claude Desktop Extensions RCE
Who wrote the file that runs on open?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- No
- Actor
- Attacker
Target
Anthropic Claude Desktop (Chrome, iMessage, Apple Notes extensions)
Impact
Command injection in three official Anthropic-written extensions; SSH keys, AWS credentials, browser passwords exposed; CVSS 8.9
Root cause
Unsanitized input handling; no sandboxing for Desktop Extensions
Sources
Catalog
Cite this: AgentProv incident record: Claude Desktop Extensions RCE (2025-11). https://agentprov.com/incidents/2025-11-claude-desktop-extensions-rce
Related
- Also L5 · 2026-10-25Planted AGENTS.md in a Downloads Folder Got Codex to Install Malware; a CLAUDE.md Variant Exposed Claude Code's OAuth TokenL5Config
- Also L5 · 2026-10-21MCP Inspector Advisory Batch: Two Critical Paths From Connecting to a Malicious MCP Server to Local Command ExecutionL5Config
- Also L5 · 2026-10-16Claude Agent SDK: A Crafted Session ID Injects an MCP Server and Runs Commands Past SDK Permissions (CVE-2026-96620)L5Config