Claude for Chrome flaw: audit what your browser agent reads

A browser AI agent works because you handed it your logged-in session. That's the entire trick — it sees Gmail because you're signed into Gmail, and it acts as you. Which means the security question was never "can the model be tricked." It's "who else can push its buttons." On July 24, Manifold Security published research showing the answer for Claude for Chrome is: any other extension you've installed. Browser AI agent security is now a permissions problem, not a model problem.

What actually happened

Two findings. The first is a missing one-line check. Claude's content script listens for clicks on an element with the ID #claude-onboarding-button and never validates event.isTrusted — the browser's own flag for "a human actually did this." Any extension with DOM access can inject a fake button, set a task ID, and dispatch a synthetic click. Claude treats it as real and runs one of nine hardcoded tasks, including reading Gmail, reviewing Google Docs comments, scheduling from Calendar, and converting Salesforce leads. The fix is if (!n.isTrusted) return;.

The second: Claude's side panel reads a skipPermissions=true query parameter from its own URL and initializes in "Act without asking" mode — the privileged setting — with no user gesture at all.

The timeline is the uncomfortable part. Manifold reported both to Anthropic on May 21 against v1.0.72, got an acknowledgment on May 22, and watched an internal ticket get marked resolved. Version 1.0.80 shipped July 7 with the handler code byte-identical to the version originally tested. Anthropic told Manifold the click issue is tracked under an earlier report that remains open pending a full fix; the URL-parameter finding was closed as informational.

Scope it honestly: BleepingComputer notes this isn't arbitrary prompt injection. An attacker needs a malicious extension already installed, and can only fire the nine built-in tasks. That's still your inbox.

Why it matters for your business

Extensions are the softest supply chain most small teams have. Nobody reviews them, they auto-update, and a PDF converter your bookkeeper installed in 2023 can change hands quietly. Layer a browser agent with your session on top and one unreviewed extension becomes a read path into email and documents.

Do three things this week. Inventory the extensions on any machine running an AI browser agent and remove what nobody can justify. Turn off "Act without asking" until Anthropic ships the fix. And run agents in a dedicated browser profile that is signed into exactly what the work requires — not the profile holding your banking, payroll, and admin consoles.

Sources: Manifold Security, BleepingComputer.