LayerX researchers have discovered a significant vulnerability within Anthropic’s Claude Desktop Extensions (DXT), which poses a remote code execution (RCE) threat through malicious Google Calendar events. Unlike competitors’ AI tools that operate within sandboxed environments, Claude DXT runs unsandboxed with full system privileges, enabling it to autonomously chain actions without user consent. This vulnerability affects over 10,000 users and more than 50 extensions.
When Claude processes a seemingly benign calendar event labeled “Task Management,” it can inadvertently execute arbitrary code following embedded instructions. This occurs through a method of indirect prompt injection, where Claude’s processing of simple prompts like “take care of it” executes malicious instructions when linked with the user’s permissions to access external systems through MCP servers. Security firm LayerX rated this vulnerability a critical 10/10 on the CVSS scale.
Although Anthropic has been informed of these findings, the company has chosen not to address the issue, stating that it lies outside their threat model as users must explicitly configure and grant permissions to MCP servers. This decision by Anthropic has sparked a debate amongst security experts about whether this vulnerability is an architectural flaw requiring a redesign, or simply an inherent risk of using autonomous AI agents, which enterprises must manage through proper deployment controls.

Collections

Security researchers discovered a critical remote code execution vulnerability in Claude Desktop Extensions that allows malicious Google Calendar events to execute arbitrary code. The flaw stems from Claude running unsandboxed with full system privileges and processing indirect prompt injections through MCP servers. Affecting 10,000+ users and 50+ extensions, the vulnerability received a 10/10 CVSS rating. Anthropic declined to fix the issue, stating it falls outside their threat model since users must explicitly grant MCP server permissions, sparking debate about whether this represents an architectural flaw or inherent risk of autonomous AI agents.

Security Concerns Over RCE Vulnerability in Anthropic's Claude Desktop Extensions