Rogue browser extension turns Claude Desktop into a remote shell; Anthropic closed the May report as duplicate
Kyrannio · x · 2026-11-07
- A researcher demonstrated that a rogue browser extension can turn Claude Desktop into a remote shell, even on another computer under the same account.
- The attack auto-clicks "Allow" every second until Claude installs a malicious npm package. The shared prompts show the full chain: trick the model into listing directories, ask Claude Code to run npm install -g add-colors-to-bash in /tmp, then claim the package belongs to a "friend" to bypass verification.
- Anthropic closed his May report as a duplicate.
More from coding & agent
- Dev uses Scenario's MCP to generate landmarks for a Dreamcast game port on Spawn — AIandDesign · 2026-11-07
- Game dev uses Scenario's MCP to auto-generate ruins, alien portals and landmarks — AIandDesign · 2026-11-07
- User has an AI teammate producing animated diagrams twice daily, today on delegation — apostraphi · 2026-11-07
- Warp built a mobile app with an AI factory in a month, cutting cost per PR from $80 to $20 — vikvang1 · 2026-11-07
- Indie dev adds Linux support via Claude Code after one premium user email complaint — yihui_indie · 2026-11-07
- SuperLedger: a single-writer decision ledger in Coda wired into Grok Bot, zero API keys — bfrench · 2026-11-07