10K Claude Desktop Users Exposed by Zero-Click Vulnerability

**Executive summary:** A newly disclosed zero-click remote code execution vulnerability in Anthropic's Claude Desktop Extensions and its Model Context Protocol (MCP) can allow a malicious Google Calendar event to cause unsandboxed, full‑privileged desktop extensions to download and run attacker code when the user issues a vague prompt; LayerX demonstrated a proof‑of‑concept and assigned a CVSS score of 10.0, recommending disabling high‑privilege extensions, restricting agent execution of local commands, enforcing least privilege, and applying endpoint and network controls.