How did the Claude Desktop zero‑click exploit work?

What security researchers found

Security researchers discovered a zero-click vulnerability in Anthropic’s Claude desktop extensions that let a crafted Google Calendar event trigger remote code execution on affected machines. The extension’s integration with calendar data treated event content as active instructions rather than inert data. That allowed an attacker to embed a payload in a calendar invite; when the desktop extension processed that invite, the payload escaped the extension’s sandbox and executed arbitrary code.

The attack chain relied on three weak points working together:

• An extension that parses third‑party content (Google Calendar) without a strict separation between data and commands.
• A container or sandbox for the Claude DXT extension that researchers judged to be weaker than expected, permitting the payload to escalate.
• The automatic syncing behavior of calendar clients, which processes incoming events without explicit user interaction, enabling a zero‑click trigger.

Who was affected and what’s still unclear

Reports say roughly 10,000 users of the desktop extension were exposed, though it’s not publicly confirmed how many devices were actually compromised in active attacks. Researchers published technical details demonstrating proof‑of‑concept exploits; however, there is still uncertainty about whether these methods have been observed in widespread, real‑world campaigns.

Practical advice and immediate mitigations

If you or your organization run the desktop extension, take steps now:

1. Disable or uninstall the desktop extension until Anthropic issues a patched release.
2. Turn off automatic calendar syncing for third‑party integrations where possible.
3. Apply endpoint detection and response (EDR) monitoring to spot suspicious child processes spawned by extensions.
4. Treat AI assistant connectors that ingest external data as high‑risk tools and subject them to code‑review and network isolation.

Longer term, providers must better compartmentalize tool integrations: treat external inputs strictly as data, enforce robust sandboxing, and add explicit user consent points for actions that could reach the OS. Until those design changes arrive, integrations that bridge cloud services and local desktop tooling remain a critical attack surface.