Zero-Click RCE in Anthropic Claude Desktop Extensions via Malicious Google Calendar Events

Security researchers at LayerX disclosed a zero-click remote code execution (RCE) issue in Anthropic Claude Desktop Extensions that can be triggered by a malicious Google Calendar event, enabling silent system compromise without the victim needing to click or meaningfully interact. The reported weakness stems from a trust-boundary failure in Anthropic’s Model Context Protocol (MCP) design, where the agent can autonomously chain data from a low-risk source (calendar content) into higher-privilege actions, potentially turning a benign user request (e.g., “take care of it”) into arbitrary local code execution.

Reporting indicates the exposure impacts 10,000+ active Claude Desktop users and 50+ extensions distributed via Anthropic’s extension marketplace. A key risk driver is that Claude Desktop/MCP extension components run unsandboxed with full host OS privileges, unlike typical browser extensions, meaning successful exploitation could allow reading arbitrary files, accessing stored credentials, and modifying system settings. One described proof-of-concept scenario involves inviting a target to a calendar event whose description embeds attacker instructions that the agent/extension chain may execute, demonstrating how routine productivity integrations can be weaponized at scale.