An Unpatched Flaw in Anthropic's AI Browser Extension Lets Other Extensions Silently Read Your Gmail

A security firm says two vulnerabilities in Claude for Chrome, Anthropic's AI browser assistant, have gone unpatched through eight consecutive software releases, allowing another browser extension to trick the AI into reading a user's Gmail messages, Google Docs, and calendar entries without a genuine click ever taking place.

The flaws were reported by the security research firm Manifold on May 21, shortly after a related vulnerability called ClaudeBleed became public. That earlier issue had let outside websites feed arbitrary instructions directly into Claude for Chrome; Anthropic's fix restricted the extension to a fixed set of nine pre-approved tasks, such as checking Gmail or opening a recent Google Doc, that could only be triggered by a click on a specific onboarding element inside the extension.

According to Manifold, the mechanism behind that click never verifies whether it actually came from a real person. Any other browser extension capable of running a script on claude.ai — a common permission many extensions already request — can fake that click with a handful of lines of JavaScript and set one of the nine pre-approved tasks running as if the user had triggered it themselves. In Claude's default "ask before acting" setting, the forged action still surfaces a confirmation prompt before anything sensitive happens. But researchers found that if a user has switched on the extension's more autonomous "Act without asking" mode, the same forged click runs the task with no visible warning until after the fact.

Manifold flagged a second, related design issue: the extension's side panel can be switched into that same no-confirmation mode through a specific URL parameter, without requiring any real user action to unlock it. A warning banner does appear once the privileged mode is active, but only after the fact, functioning as a notice rather than a safeguard. Researchers say this particular path isn't exploitable by outsiders today, since only the extension itself currently has a way to construct that URL — but they describe it as a structural risk that a future bug, such as a cross-site scripting flaw elsewhere in the extension, could turn into a fully silent path to a user's accounts.

Anthropic acknowledged Manifold's report the day after it was filed and closed both tickets, according to Manifold — one on the grounds that the underlying issue was already being tracked as part of the still-open ClaudeBleed fix, and the other as informational, since the disputed URL parameter is normally only ever set by the extension itself. Despite that, Manifold says its comparison of the current release, version 1.0.80, against the originally reported version found the relevant code effectively unchanged. As of publication, Anthropic had not issued a public statement addressing Manifold's specific findings.

Security researchers who reviewed the disclosure note that the underlying weakness is difficult for standard security monitoring to catch, since the resulting activity looks like ordinary, authenticated use of Gmail and Google's other services rather than anything unusual showing up in access logs. For users, the practical takeaway from multiple researchers is straightforward: avoid enabling "Act without asking" style autonomous modes in AI browser extensions until trust boundaries like this one are fully closed, and review which other extensions have permission to run scripts on any AI assistant's own site.