Researchers at Manifold Security discovered a vulnerability in Claude in Chrome (version 1.0.80) where it could mistake a synthetically generated click for a user action. This allowed another extension with DOM access to Claude's page to trigger predefined workflows, including accessing Gmail, Google Docs, or Salesforce. While the default mode requires user confirmation, a 'Act without asking' mode could execute these actions without explicit user consent, posing a significant security risk. The vulnerability was confirmed by The Hacker News and affects Opus, Sonnet, and Fable models, indicating the issue lies in event handling rather than the AI model itself. AI
IMPACT This vulnerability highlights the need for robust security in AI browser extensions, particularly concerning how they handle user interactions and permissions.
RANK_REASON Security vulnerability discovered in a specific browser extension integration of an AI model.
AI-generated summary · Google Gemini · from 1 sources. How we write summaries →
