Israeli security company LayerX recently disclosed a critical vulnerability targeting Claude Desktop Extensions (now renamed MCP Bundles). Researchers found that attackers could exploit this vulnerability to achieve "zero-click" remote code execution, with the potential impact reaching the maximum score of 10/10 on the CVSS scale.

The core of the vulnerability lies in the fact that Claude automatically processes input information from external connectors, such as Google Calendar. Attackers only need to send a Google Calendar invitation containing malicious instructions. When users let Claude handle the schedule, the AI model might autonomously decide to call plugins with command execution permissions to execute these hidden instructions. Due to the lack of strong protection in Claude's processing of such workflows, malicious code can be downloaded, compiled, and executed without user confirmation.

In response to this discovery, Anthropic stated that they currently do not plan to fix the issue. The company responded that MCP plugins are designed as local development tools, and their security boundaries are determined by the user's configuration and permissions. Users should take responsibility for the local servers they choose to install and authorize. Security experts, however, countered that although Claude claims the plugins run in a sandbox, the current permission control logic clearly fails to provide the expected protection against complex indirect prompt injection attacks.

Key Points:

  • 🚨 High-Risk Vulnerability Alert: The Claude plugin system has been exposed to a level 10 security vulnerability, allowing malware to achieve zero-click remote execution through Google Calendar items.

  • 📅 Attack Path: Exploiting the AI's ability to automatically read calendars, attackers can disguise malicious code as calendar tasks, prompting the AI to call high-privilege tools to execute attacks.

  • 🛡️ Official Response: Anthropic believes this is beyond its current threat model, emphasizing that security responsibilities should be borne by users who independently install and authorize plugins.