Claude Desktop Extensions Exposes Over 10,000 Users to Remote Code Execution Vulnerability

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Zero-Click RCE Vulnerability Discovered in Claude Desktop Extensions A zero-click remote code execution (RCE) vulnerability has been identified in Claude Desktop Extensions, allowing attackers to compromise systems through a single Google Calendar event. This flaw affects over 10,000 users and 50 extensions, as the extensions operate with full system privileges. LayerX reported the vulnerability on February 9, 2026, but Anthropic has declined to issue a fix. 21 sources 36