A vulnerability in Anthropic's Claude Chrome extension allows malicious browser extensions to trigger predefined AI workflows without genuine user interaction, exploiting a failure to validate whether click events originate from real users. The flaw, discovered by Manifold Security, stems from the extension's inability to check the Event.isTrusted property before executing nine built-in tasks—including reading Gmail and modifying Salesforce leads. A malicious extension with access to claude.ai can inject synthetic click events that the Claude extension treats as legitimate user actions, effectively hijacking authenticated connections to Gmail, Google Docs, Google Calendar, and Salesforce. Anthropic acknowledged the synthetic-click vulnerability through its bug bounty programme but classified it as already tracked, whilst a secondary finding involving a skipPermissions parameter was marked informational. Critically, both flaws remain exploitable in version 1.0.80, released 7 July.
For CX teams relying on Claude integrations with Salesforce or other connected services, this vulnerability creates a material risk window. The attack requires users to install a malicious extension, but the damage potential is severe: an attacker could modify leads, read customer communications, or manipulate calendar data without triggering permission prompts if users have enabled the "Act without asking" setting. Teams should audit which Claude workflows are enabled in their environments and whether staff have granted automatic execution permissions—particularly those managing high-value accounts or sensitive customer data. The question becomes whether your organisation's current extension governance policies catch rogue installations before they reach production systems, or whether you're relying on user vigilance alone.
The broader implication extends beyond Claude itself. This vulnerability exemplifies the authentication trust problem in agentic AI systems: as AI agents gain deeper access to business tools, the validation mechanisms protecting that access must be equally rigorous. CX platforms increasingly embed AI agents that interact with Salesforce, email systems, and knowledge bases—if those agents can be manipulated through extension-level attacks, the integrity of customer data and support workflows is compromised. Until Anthropic releases a patched version that properly validates user intent, teams should consider disabling Claude's automatic execution features and requiring explicit approval for sensitive workflows, even if it slows operational efficiency.
A flaw in Anthropic's Claude for Chrome browser extension could allow a malicious extension to trigger predefined AI actions by simulating user clicks, potentially allowing it to abuse Claude's access to connected services such as Gmail, Google Docs, Google Calendar, and Salesforce. [...]