Vulnerability in Anthropic Claude Extensions Allows Remote Code Execution via Google Calendar

LayerX’s report highlights a serious vulnerability in Anthropic’s Claude Desktop Extensions (DTX), which impacts more than 10,000 active users and 50 extensions. The flaw allows for zero-click remote code execution (RCE) through Google Calendar invites, where a maliciously crafted calendar event can trigger arbitrary local code execution without user awareness. This vulnerability is particularly concerning as it stems from the extensions running unsandboxed with full system privileges, unlike traditional browser extensions.

Roy Paz, a principal security researcher at LayerX, explained that the extensions can autonomously connect low-risk connectors like Google Calendar to high-risk local executors. This means that a simple user prompt, such as ‘take care of it,’ can lead to executing harmful commands through the AI model without explicit user consent. The researchers demonstrated this by labeling a calendar event as ‘Task Management’ and instructing the AI to run a git pull from GitHub, which resulted in full RCE.

The implications of this vulnerability are significant, as it creates system-wide trust boundary violations in workflows driven by large language models (LLMs). LayerX noted that the automatic bridging of benign data sources into privileged execution contexts is fundamentally unsafe. The lack of safeguards in the Claude model allows it to construct unsafe execution paths, making it susceptible to exploitation.

Despite being notified of the vulnerability, Anthropic has not taken steps to address it. This raises concerns about the safety of using MCP connectors in security-sensitive environments, as they enable AI models to access external data and applications but also introduce various security risks. These risks include unauthorized command execution and potential data leaks.

Organizations are urged to reconsider the use of MCP connectors on critical systems until adequate safeguards are implemented. The findings from LayerX underscore the need for enhanced security measures to protect against the evolving threats posed by AI technologies.

• Anthropic Claude Desktop Extensions: These extensions run unsandboxed with full system privileges, allowing for significant security risks.
• Google Calendar: The vulnerability allows calendar events to trigger remote code execution without user awareness.
• LayerX: The cybersecurity firm that reported the vulnerability, highlighting the risks associated with AI models.
• Remote Code Execution (RCE): A critical vulnerability that allows attackers to execute arbitrary code on a compromised system.
• Machine Context Protocol (MCP): A framework that enables AI models to access external data, which can introduce security concerns.