Researchers Warn of Data Exposure Risks in Claude Chrome Extension

Zenity Labs' analysis of Anthropic's Claude Chrome extension warns that the extension remains persistently logged in and can act using users' credentials, enabling attacks like indirect prompt injection and JavaScript execution that can expose OAuth tokens, perform actions in services (e.g., Google Drive, Slack), and facilitate lateral movement; researchers demonstrated proof-of-concept abuses and noted that built-in mitigations like "Ask before acting" are insufficient.