So the Claude extension allows any other extension to inject JavaScript into claude.ai and run it? Cool cool cool.
Yeah, don't let this one in.
Post
Replies:
13
Boosts:
17
@mttaggart Wait, so any extension with zero permission can execute XSS code on any origin? Injecting prompts to claude is the least of my worries then. With that, can't the same extension just steal your github credentials?
@mttaggart I looked a bit into it - apparently, Chrome does not require specific permissions beyond agreeing to install the extension, to inject content into the MAIN context of a page.
So, it looks like all of the demonstrated things (stealing emails, exfiltrating repos, etc.) could be done with just a malicious extension, completely skipping the claude step.
The only benefit it gives the attacker is that they can just tell claude what to do for them, instead of having to write (or vibecode) an actual exploit script.
So, for the demonstrated exploits, the claude extension doesn't really seem to add any new capabilities beyond what an installed extension can do anyways.
@hweissi The issue here is the security boundary of externally_connected being broken because of the nature of the extension.
Any extension can request the scripting permission to inject JavaScript; that is true. Extensions are a huge security issue, but that's not the full story here.
When an extension does so on claude.ai, the Claude extension's externally_connectable manifest values allow that malicious script to send messages to the Claude extension itself, without explicitly requesting the runtime permission usually required for message sending. As a result, the injected code can't just watch the DOM—which again, yes, is a thing all extensions can do—, it can send messages to Claude via the extension, gaining access to Claude itself and the data stored therein.
Interestingly, it would seem the "fix" from Anthropic to add additional approvals for certain actions is also bypassable.
@mttaggart So does that mean you can essentially get local code execution by communicating with a locally-running claude instance? That would be a bigger issue.
If it's only Claude in the browser, performing clicks for you - i don't think there's a lot of extra capabilities you get, compared to what you have already when you get someone to install the extension.
After all, why communicate with a different browser extension, when you already have a browser extension running?
However, still not great sandboxing by anthropic obviously.
@mttaggart
They can't have vulnerabilities they have mYtHoS
@mttaggart yikes, extension permissions are such a mess. the name ClaudeBleed is dramatic but the issue is real
@mttaggart An "AI tool" is vibe coded insecure slop? Who would've thunk™
(btw #opencode is insecure crap, too, yet it has a scary amount of users)
@mttaggart
this calls for the claude emoji: 🤡
@mttaggart @briankrebs Mythos really missed this one, eh?
@mttaggart browser extension development and security practices writ large are stuck in 1995 I stg
@mttaggart VANILLA is good. No external dependencies should be pressed a little bit harder. And... it would be great to have that packaged in a single file. Try telling these 'Claudes' to do it that way.
@mttaggart this is why Anthropic needs to make Mythos available, so companies like Anthropic can catch these bugs!
@mttaggart The "s" in Anthropic stands for security
