Claude for Chrome shipped eight releases after a researcher showed its permission gate never checks who clicked, and the eighth still shipped it, byte for byte.
Manifold Security found it on May 21. The extension’s content script watches for a click on one onboarding button, reads the task ID sitting on it, and fires. It never checks whether the click came from a person, because it never reads the one browser property built for exactly that, event.isTrusted. Any other extension already running in the tab, ordinary permissions, no exploit, can build that button itself, set the task ID, and dispatch a synthetic click. Six lines from a DevTools console reproduce it. The task ID is not free text: the attacker picks from nine hardcoded workflows, no arbitrary prompting. Then read the nine. Open the inbox and click unsubscribe on whatever looks promotional. Open the latest Google Doc and read every comment. Read the calendar and book a meeting. Reach into Salesforce and convert a lead. Manifold scores the flaw a 7.7 in the default mode. Flip on the setting Anthropic now calls Skip all approvals, formerly Act without asking, the one it ships behind a warning to use “only when you completely trust every action, connector, file, app,” and Manifold’s number jumps to 9.6, a hair under the top of the scale. Those are the researcher’s own numbers. There is no CVE.
I have argued for a while that systems beat people precisely because a system can be held to a standard a person can’t: run it twice, get the same answer, audit the check. That only holds if the thing the system checks is real. Here the gate checks that a click arrived. It never asks the browser who made it. And event.isTrusted is the one bit the browser will not let a script forge: a synthetic click carries isTrusted: false, always, by construction. The property was sitting right there, unforgeable and unread. A gate that takes any click it is handed is not a lesser version of asking a person for consent. It is worse, because a stranger cannot fake a nod, and a stranger’s extension does not have to fake anything: it clicks, and the gate never thinks to ask. Software testing has the identical failure under a different name. A test that already knows the answer it is grading against only rehearses testing. A permission check whose pass condition the attacker also supplies only rehearses checking permission.
The obvious objection is the right place to start, and it is not the severity number. BleepingComputer puts the precondition plainly: to fire that click I need a malicious extension already running in your browser. Grant that, and haven’t I lost already? An extension that asks for access to every site can read your Gmail on its own. It does not need Claude as a go-between. True. So here is what the click actually buys. It does not need the everything-access extension. It needs one with a content script on claude.ai and nothing else, the kind that clears Web Store review looking like a theme or a note-taker, because claude.ai is all it declares. That narrow, innocent-looking extension inherits Claude’s authenticated reach into every service you connected: the inbox, the docs, the calendar, the CRM. It spends a permission it was never granted and could never have asked for. That synthetic click is a key to rooms the attacker’s own credentials do not open.
Two honest caveats stand. This is not a page that empties your Gmail on load. Some hostile extension has to be installed first, ordinary permissions, no zero-day. And Anthropic did not sit on the report. Someone triaged it inside a day, credit where it is due. I should also say where I stand: I sell agent software too, a fleet that acts on the same revenue data this exploit reaches into, and the one rule I will not move on is that a human really approves anything that leaves the building. This is a rock thrown from inside the glass house, and the same standard lands on me. Which is why the second failure is the one I can’t let go.
The second failure is the same shape as the first. Anthropic’s own words, in the researcher’s writeup: the residual capability “is tracked under the original report, which remains open pending a complete fix.” Remains open. A complete fix, promised. Then, before June 9, the internal tracker for that same issue read Resolved. Eight releases later, on July 7, Manifold pulled version 1.0.80 apart and found the content script and the side-panel handler byte-identical to the build it first reported in May. Nothing had shipped. What Resolved meant inside Anthropic I can’t tell you, and neither can the researchers: whether it “reflects work planned for a future release or a determination that the residual capability doesn’t warrant further code change isn’t something we can determine from outside.” Fine. Here is the part that needs no mind reading. Whatever the flag meant, nobody reconciled it against the shipped build, or the six-line reproduction would have surfaced before July. A status field flipped to Resolved on an issue the company had, in writing, called open pending a complete fix, and no one diffed the flag against the code.
A company whose entire pitch is that a machine can act correctly without a human re-checking every step let a ticket that read Resolved stand in for a fix nobody had re-tested. Trust the flag, skip the artifact. It is the identical shape as the bug: the gate trusted the click and never checked the person; the process trusted the status and never checked the code.
A permission gate exists to replace a person’s judgment with something more reliable, not something easier to fool. Claude for Chrome asked whether a click had happened. It never asked whether a person had made it, and it shipped that gap for eight releases running. A tracker said Resolved. The code said otherwise. Nobody made them agree. The company selling agents you are meant to trust without watching over their shoulder spent two months not watching its own.
Sources:
- Manifold Security, “ClaudeBleed Reopened: Browser Extensions Can Still Push Claude for Chrome to Read Your Gmail”
- BleepingComputer, “Claude Chrome extension flaw lets malicious extensions trigger AI actions”
- Anthropic, “Claude in Chrome permissions guide” (the current mode names and the autonomous-mode warning)