A new cybersecurity report has raised concerns about Anthropic’s Claude Desktop app silently enabling deep browser access without user consent.
Quick Summary – TLDR:
- Claude Desktop reportedly installs a hidden browser integration across multiple Chromium browsers.
- The feature allows out-of-sandbox access with powerful automation capabilities.
- Researchers warn of security risks including prompt injection and system level access.
- Experts are urging clear user consent and stricter controls from Anthropic.
What Happened?
A report by privacy researcher Alexander Hanff revealed that Claude Desktop for macOS installs a Native Messaging bridge without notifying users. The integration connects browser extensions to a local executable with elevated access. This setup could bypass standard browser security protections and expand the system’s attack surface.
https://t.co/5y99mcVMvP@AnthropicAI secretly installs spyware when you install Claude Desktop Anthropic’s Claude Desktop silently installs a Native Messaging bridge into seven…#ai #privacy #eprivacy #compliance #infosec #gdpr #law #cyber #security #anthropic #claude
— That Privacy Guy (@alexanderhanff) April 20, 2026
Hidden Browser Integration Raises Red Flags
The investigation found that the Claude Desktop application automatically creates a configuration file named com.anthropic.claude_browser_extension.json across several Chromium based browsers. These include Google Chrome, Brave, Microsoft Edge, Chromium, Arc, Vivaldi, and Opera.
Notably, the file is installed even on systems where some of these browsers are not present. The application also rewrites the file every time it launches, making it difficult for users to remove it without uninstalling the app entirely.
This behavior has been described by Hanff as a dark pattern, suggesting users are not given meaningful control or awareness over the integration.
Powerful Capabilities Outside Browser Security
At the center of the concern is a local executable called chrome native host, which runs outside the browser sandbox with full user level privileges. Through this bridge, specific pre approved browser extensions can directly communicate with the system.
This enables a range of powerful actions, including:
- Reading full web page content and DOM data.
- Extracting structured information from websites.
- Accessing authenticated sessions and login states.
- Automating form submissions.
- Performing background screen recording.
Such capabilities allow the system to interact with sensitive platforms like banking portals, enterprise dashboards, and administrative systems as if it were the user.
Security Risks and Attack Scenarios
Experts warn that this architecture significantly increases the attack surface for users. According to available data, Claude’s browser integration still shows a measurable vulnerability to prompt injection attacks, with a reported success rate of 11.2 percent.
If exploited, attackers could:
- Execute commands on the local machine through the bridge.
- Hijack authenticated sessions.
- Access sensitive business or financial systems.
- Exploit compromised browser extensions through supply chain attacks.
The report highlights that even inactive or dormant integrations can become dangerous if leveraged by malicious actors.
Legal and Privacy Concerns
Hanff also raised concerns about potential violations of the EU ePrivacy Directive, arguing that silent installation without user consent may breach established privacy regulations.
The hidden nature of the feature undermines the traditional browser trust model. Users are left unaware of persistent system level hooks that could impact long term privacy and security.
Calls for Transparency and User Control
Cybersecurity experts and privacy advocates are calling on Anthropic to implement immediate changes.
Recommended steps include:
- Introducing a strict opt-in model for browser integrations.
- Providing clear prompts and explanations before installation.
- Limiting integration to browsers actively chosen by users.
- Adding transparent controls to manage or revoke permissions.
Organizations using Claude Desktop on macOS are advised to audit their systems and check for the presence of the configuration file to ensure compliance with internal security policies.
SQ Magazine Takeaway
I think this situation highlights a growing tension in AI tools between convenience and control. While deeper browser integration can unlock powerful automation, doing it silently crosses a line. Users deserve to know exactly what is running on their machines, especially when it involves access to sensitive data. If companies like Anthropic want long term trust, transparency cannot be optional. It has to be built into the product from day one.
