Red teamers turned Claude Desktop into a double agent to do their evil bidding

Pentera Labs' red team demonstrated that a compromised inbox and Claude Desktop's synced personal preferences can be abused to inject commands into a user's AI assistant, yielding remote code execution, persistent C2 behavior, and lateral access from a developer's workstation; the vendor considered the capability "working as intended," leaving an attack surface for organizations using agentic desktop AI apps.