Back Cyberpress

Claude Desktop Extensions Zero-Click RCE Flaw Exposes Over 10,000 Users to Silent Attacks

Cyberpress • February 10, 2026

With full access, it downloads malware and executes it on your machine. Boom RCE achieved remotely. LayerX demoed this by chaining a low-risk app ( ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Zero-Click RCE Vulnerability Discovered in Claude Desktop Extensions A zero-click remote code execution (RCE) vulnerability has been identified in Claude Desktop Extensions, allowing attackers to compromise systems through a single Google Calendar event. This flaw affects over 10,000 users and 50 extensions, as the extensions operate with full system privileges. LayerX reported the vulnerability on February 9, 2026, but Anthropic has declined to issue a fix. 21 sources 36

Extracted Entities

Claude Desktop Extensions Zero-Click RCE Flaw Exposes Over 10,000 Users to Silent Attacks

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)