Claude Desktop Extensions 0-Click RCE Vulnerability Exposes 10,000+ Users to Remote Attacks

**Zero-click RCE in Claude Desktop Extensions:** LayerX disclosed a critical architectural vulnerability (CVSS 10/10) in Claude Desktop Extensions where a malicious Google Calendar event can be interpreted by the model and cause a privileged local MCP extension to fetch and execute attacker code, resulting in full system compromise; researchers recommend disconnecting high-privilege local connectors from agents that ingest untrusted external data.