2026-07-22

Claude for Chrome has a trust problem

For anyone building with Claude, this is a pretty uncomfortable reminder that browser-based AI agents inherit the browser’s entire mess of permissions and attack surfaces. The headline isn’t that Claude can do things in Gmail, Docs, Calendar, and Salesforce — that part is the appeal — it’s that a malicious extension could reportedly fake a user click and get those built-in workflows to run anyway.

Key Points

A flaw in Anthropic’s Claude for Chrome extension could let a malicious extension trigger predefined AI actions by simulating user clicks.
The issue was reported by Ax Sharma of Manifold Security and comes down to how the extension decides whether a task was intentionally requested by the user.
Chrome extensions with site permissions can inject JavaScript, read and modify page contents, and generate synthetic click and keyboard events.
Claude’s extension listens for clicks on a specific page element that launches built-in workflows.
The built-in workflows mentioned include Gmail actions, Google Docs reading, Google Calendar scheduling, and Salesforce lead conversion.
The extension reportedly failed to check Event.isTrusted, so JavaScript-generated clicks were treated like real user interactions.
The attack is limited to the extension’s nine predefined tasks; it is not arbitrary prompt injection.
An attacker would still need to trick a user into installing a malicious extension that can run on claude.ai.
The main concern is abuse of Claude’s authenticated access to connected services.
Impact depends on configuration, including whether the user must approve sensitive actions or has “Act without asking” enabled.
Manifold also found an internal skipPermissions=true parameter that bypassed some checks, but it was not directly exploitable on its own.
Anthropic acknowledged the reports; the synthetic-click issue was closed as something they were already tracking, and the second finding was marked informational.
Manifold says the issues remain reproducible in the latest extension version they tested, 1.0.80, released on July 7.

My Take

What strikes me is that this is less a Claude-specific “AI bug” and more a very old browser security problem wearing a new suit. If you let an assistant act on your behalf inside a browser, then anything that can impersonate the user’s intent becomes part of the threat model. That’s the real lesson here, and it’s not especially glamorous.

I think the most interesting detail is the narrow scope. This apparently doesn’t give an attacker free-form control over Claude; it abuses a fixed set of workflows. That sounds limited on paper, but in practice those workflows are exactly where the value is. Reading email, touching docs, creating meetings, modifying CRM records — that’s real damage if a malicious extension can steer it.

The isTrusted miss is also one of those bugs that feels almost annoyingly classic. Browsers go out of their way to distinguish genuine user input from synthetic events for a reason. If an extension ignores that signal, it’s basically asking to be tricked. I’d be curious whether Anthropic will harden this by requiring a stricter gesture chain, extra confirmation, or some kind of server-side verification before a workflow fires.

The “Act without asking” setting is where my skepticism kicks in. I get why people want it. I also think it’s the kind of option that looks incredibly convenient right up until a safety boundary gets blurred. If I were using Claude for anything connected to email, docs, or Salesforce, I’d keep that off unless I had a very specific workflow and was comfortable with the blast radius.

If you’re building against Claude’s browser surface, this is a good reminder to assume extension-level adversaries exist. Don’t rely on a click alone as proof of user intent. And if you’re a user, especially a power user, I’d treat any extension that can run on claude.ai as part of your trust perimeter, not as harmless chrome.

The takeaway is simple: browser agents are only as trustworthy as their weakest input signal. Here, that weak signal was a click. That’s small, but it’s enough.