Zero-Click RCE Vulnerability in Claude Desktop Extensions Exposes 10,000+ Users
Security researchers at LayerX discovered a critical zero-click remote code execution vulnerability affecting over 50 Claude Desktop Extensions and 10,000+ active users. The flaw allows attackers to compromise systems via malicious Google Calendar events by exploiting how the Model Context Protocol chains tools without enforcing security boundaries. Anthropic reportedly declined to fix the vulnerability.
What happened
Security researchers at LayerX disclosed on February 9, 2026 a zero-click remote code execution vulnerability affecting over 50 Claude Desktop Extensions (DXT) and impacting more than 10,000 active users, with a CVSS score of 10.0.
The vulnerability allows attackers to achieve remote code execution by crafting a malicious Google Calendar event. When a user prompts Claude with a benign request like 'check my latest events and take care of it,' the AI model autonomously interprets the instruction as authorization to execute arbitrary tasks embedded in the calendar event without requiring user interaction.
Reported impact
Claude Desktop Extensions execute without sandboxing and with full privileges on the host system, enabling attackers to read arbitrary files, execute system commands, access stored credentials, and modify operating system settings if the vulnerability is exploited.
The vulnerability stems from the Model Context Protocol's architecture, which allows Claude to autonomously chain together different tools such as Google Calendar and local code executors to fulfill user requests without enforcing proper security boundaries.
Index analysis
Unlike traditional browser extensions that operate within sandboxed environments, Claude Desktop Extensions are Model Context Protocol servers packaged in .mcpb bundles that run with full system privileges on the host machine without sandboxing protections.
The attack vector is a Google Calendar event containing instructions to clone a malicious Git repository and execute code. The flaw exploits how MCP-based systems autonomously chain low-risk data sources to high-privilege execution tools without user consent or hardcoded safeguards.
Governance controls
According to LayerX principal security researcher Roy Paz, Anthropic decided not to fix the vulnerability at the time of disclosure.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.