I have built my digital life around AI tools, and I suspect you have too. We trust them because they feel like they are waiting for our command. That assumption just got a little more dangerous.
Security researchers at Manifold disclosed this week that a flaw in Anthropic’s Claude for Chrome browser extension allows any malicious Chrome extension to trigger Claude’s built-in AI workflows without requiring a real user click. The extension does not verify whether a click event originates from a human or from JavaScript injected by another extension. It simply executes.
That matters because Claude’s extension comes with nine predefined tasks out of the box. These are not trivial automations. One reads your recent Gmail and clicks unsubscribe links. Another opens your latest Google Doc and reads all comments and feedback. A third scans your Google Calendar for free slots and creates meetings. A fourth modifies Salesforce leads and converts them to opportunities. Each of these runs using Claude’s authenticated access to services you have already approved.
The numbers are sobering. The vulnerability persists in version 1.0.80, released on July 7, 2026. Manifold confirmed the fix has not landed weeks after disclosure. The attack is limited to those nine predefined tasks, which sounds restrictive until you remember what those tasks actually touch: your email, your documents, your calendar, your customer pipeline.
Why the browser’s own safety net failed
Every modern browser marks real user interactions with a flag called Event.isTrusted. When you physically click something, that flag is true. When JavaScript generates a click event programmatically, the flag is false. Reputable browser extensions check this property before acting on user input. Claude’s extension does not.
A malicious extension with permission to run on claude.ai can inject a page element containing one of those nine task identifiers, fire a synthetic click event, and watch Claude execute the workflow. The attacker never needs to compromise your password. They never need to phish you. They only need you to install one dodgy extension alongside the legitimate Claude add-on.
The second vulnerability is less direct but still interesting. Researchers found an internal skipPermissions=true parameter that bypassed certain permission checks. Anthropic classified that finding as informational rather than exploitable on its own. Manifold disagreed with the severity rating but acknowledged it would need another bug to weaponise fully.
What you should do right now
First, audit every Chrome extension on any machine where you use Claude. If you have extensions you did not install deliberately, remove them now. This is good hygiene regardless of today’s disclosure.
Second, reconsider whether you need Claude’s browser extension at all. The convenience of reading Gmail or Calendar through an AI assistant comes with an expanded attack surface. If you only use Claude for coding or writing, the extension adds risk without adding value.
Third, never enable the ‘Act without asking’ setting in Claude for sensitive workflows. Autonomous execution is exactly what this flaw exploits. Human confirmation before any workflow touches email, calendar, or CRM data is the sensible default.
Browser extensions have become trusted intermediaries, and trust is exactly what attackers are exploiting. The perimeter is no longer the network. It is the extension bar.