Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Claude Desktop Extensions zero-click RCE flaw

Vulnerability
First reported
Last updated
Happening score
H score 25
1 unique sources, 1 articles

Summary

Hide ▲

A zero-click vulnerability in Claude Desktop Extensions (DXT) can let a Google Calendar event trigger remote code execution on vulnerable systems, creating high-risk host compromise for up to 10,000 active users. LayerX said the flaw affects 50 DXT and assigned it CVSS 10.0. Anthropic was notified but said it would not fix the issue at this time.

Related Happenings

Anthropic Claude Code usage-limits bug causing faster exhaustion

Service Disruption
First: 01.04.2026 03:32 Last: 01.04.2026 03:32 Sources 1

About this happening: Anthropic is investigating a **Claude Code** bug that makes **usage limits** exhaust much faster than expected, leaving affected users blocked from normal use. The issue was still...

Open Happening

LayerX font-rendering PoC exposes a browser-rendering gap in AI assistant analysis

Technical Analysis
First: 17.03.2026 15:59 Last: 17.03.2026 15:59 Sources 1

About this happening: A **LayerX** proof-of-concept showed that a **font-rendering attack** can hide malicious webpage commands from AI assistants, creating a risk of **unsafe guidance** when the brows...

Open Happening

Anthropic Claude Code code injection and API key disclosure flaws (multiple vulnerabilities)

Vulnerability
First: 25.02.2026 19:00 Last: 25.02.2026 19:00 Sources 1

About this happening: **Anthropic's Claude Code** has multiple disclosed flaws that can enable **remote code execution** and **API key theft** when developers open **untrusted repositories**. The issue...

Open Happening

Ghostscript OpenSC and CGIF memory corruption flaws memory corruption flaw

Vulnerability
First: 06.02.2026 07:49 Last: 06.02.2026 07:49 Sources 1

About this happening: **Ghostscript**, **OpenSC**, and **CGIF** were among the open-source libraries affected by a newly disclosed batch of **more than 500 previously unknown high-severity flaws**. The...

Open Happening

Anthropic launches Claude Opus 4.6 with code review and vulnerability-finding capabilities

Security Tool/Service
First: 06.02.2026 07:49 Last: 06.02.2026 07:49 Sources 1

About this happening: **Anthropic** launched **Claude Opus 4.6** with stronger **code review** and **debugging** support, and the model has already been used to uncover **more than 500** previously unk...

Open Happening

Timeline

  1. 09.02.2026 19:30 2 articles · 3mo ago

    LayerX discloses zero-click RCE in Claude Desktop Extensions

    Initial Disclosure

    LayerX disclosed a critical zero-click vulnerability in Claude Desktop Extensions (DXT) where a malicious Google Calendar event could trigger remote code execution on a vulnerable host running Claude Desktop Extensions with full privileges. The issue was described as affecting 50 Claude Desktop Extensions (DXT) and potentially over 10,000 active Claude DXT users, and LayerX assigned it a maximum-severity CVSS score of 10.0. LayerX said the vulnerability was reported to Anthropic, which said it would not fix the issue at this time and characterized the scenario as falling outside its current threat model.

    Show sources
    Open in new tab