Claude Desktop Extensions Expose Users to Critical Zero-Click RCE Vulnerability

A critical new vulnerability in Claude Desktop Extensions — the plugin ecosystem used by Anthropic’s Claude AI assistant — has sent shockwaves through the cybersecurity community by exposing more than 10,000 active users to silent, zero-click remote code execution (RCE). The flaw, uncovered by Israeli security firm LayerX, illustrates a fundamental architectural weakness in how AI agents process external data and integrate deeply with local systems — a weak point attackers could exploit without any interaction from victims.

What Is the Zero-Click RCE Vulnerability?

This issue does not require traditional phishing, social engineering, or tricking a user into clicking a malicious link. Instead, it enables an attacker to send something as benign-looking as a Google Calendar invitation that secretly contains a malicious payload. When the targeted user later asks Claude to “check my calendar and take care of it,” the AI innocently retrieves that malicious content and executes it via its extensions with full system privileges — all without notifying the user or asking for consent.

LayerX assigned this vulnerability the highest possible severity rating — a CVSS score of 10.0 — because it enables arbitrary code execution at the operating system level with no user interaction required. This type of weakness, known as a zero-click exploit, is among the most dangerous in cybersecurity because it can be triggered silently and broadly.

Why This Vulnerability Is So Dangerous

At the core of the problem is how Claude Desktop handles plugins — technically referred to as Model Context Protocol (MCP) extensions. Unlike typical browser extensions that run within a sandboxed environment with strict permission limits, Claude’s MCP extensions operate outside a sandbox and are granted full access to the host system. That means they can read files, modify system settings, execute programs, access stored credentials, and perform other powerful tasks just like any other local application.

When Claude processes a user request, it autonomously decides which tools or connectors to invoke. If an attacker has inserted crafted instructions in something like a calendar event, the AI’s autonomous workflow can inadvertently combine low-risk connectors such as Google Calendar with high-risk system tools — and trigger them without prompting the user. Researchers describe this as a trust boundary violation: data from an external, untrusted source flows directly into a context where it can execute privileged actions.

How an Attack Works in Practice

LayerX demonstrated an exploit scenario dubbed the “Ace of Aces” where an attacker crafts a Google Calendar event named something innocuous like “Task Management.” Inside the event description, they embed instructions for a Git repository to be cloned and executed. If the victim later asks Claude to check and “take care of” their schedule, Claude interprets this as a valid directive and executes the malicious commands.

Because Claude Desktop Extensions are inherently unsandboxed and run with the access level of the logged-in user, the malicious commands execute with full privileges — meaning the attacker could gain complete control of the victim’s system without their knowledge.

Architectural Weakness, Not a Simple Bug

Importantly, this vulnerability isn’t a traditional software bug like a buffer overflow or input injection error. Instead, it stems from a design choice in Claude’s architecture — how its autonomous workflow mechanism chains tools and connectors without sufficient validation or permission controls. Researchers emphasize that this is a workflow failure rather than a simple coding mistake.

Anthropic, the developer behind Claude, was notified of LayerX’s findings but reportedly declined to issue an immediate fix, asserting that MCP extensions are intended for local development and that the responsibility for securing them lies partly with users and administrators. This stance has drawn criticism from security professionals who say that such deep integration into user systems demands stricter controls.

Implications for Users and Organizations

The breadth and ease of this attack raise serious concerns about the security of AI-driven automation tools. Over 50 separate Claude Desktop Extensions are affected, and any installation that combines system-level access with connectors that process external data is potentially at risk.

Security experts recommend that users disconnect or disable high-privileged MCP extensions — especially those that interact with untrusted sources like calendars or email — until a comprehensive security fix is developed. Organizations that use Claude Desktop for handling sensitive workflows or systems should treat these agents with the same caution normally reserved for privileged administrative software.

A Wider Warning on AI Agent Security

This incident underscores a broader trend: as AI assistants evolve from simple chatbots into powerful autonomous agents integrated with productivity tools and local systems, the attack surface grows significantly. What once required human consent or interaction can now be exploited silently, highlighting the need for robust security models tailored to agentic AI systems.

Until Claude and similar tools adopt stricter isolation mechanisms, explicit permission controls, and better validation of external inputs, zero-click threats will remain a looming risk in the era of AI-driven workflows.