Cases › other › LR-2026-0387

Researchers warn of data exposure risks in Claude Chrome extension

Preliminary Why: 1 report: Hackread · subject to change · 1 independent report

Status: no action reported

Severity minor

Reported 5 Jan 2026

Developer and model Anthropic

No source states: loss or records, agent tool, could do, deployer, industry.

Severity minor: Test: contained to researcher evaluations of one product; the source states no third party touched and no real-world loss

Anthropic released a beta of its Claude Chrome extension, which lets the AI browse and act on websites for the user. Researchers noted the extension stays logged in at all times and inherits the user's identity and private access. In technical tests, Claude could read web requests and console logs, which can expose data such as OAuth tokens. Its Ask before acting switch was judged a soft guardrail, because in one test Claude went to Wikipedia outside the approved plan. These are research findings; the sources state no real-world loss. Researchers also warned of approval fatigue, where users stop checking what the AI does.

What happened

1 · What it was doingAnthropic's beta Claude Chrome extension let the AI browse and act on websites for users.

2 · What went wrongThe extension stays logged in at all times with no way to disable it, so Claude inherits the user's access.

3 · How it was caughtZenity Labs flagged three overlapping concerns in its technical blog post.

What was done

No source states an action or fix.

Risks

Data leaked or sent out
Primary32 incidents

Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Network egress control

Application

Sensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs

Similar incidents

Hacktron researchers use Claude to access OpenAI employee ChatGPT accounts2026-09-18

Backdoored Anthropic Claude VS Code extension on Cursor marketplace (v2.1.313) installs SSH backdoor for up to 5,000 developers2026-10-30

Claude in Chrome indirect prompt injection chain: inbox exfiltration, Drive persistence and account takeover2026-08-05

Unreleased Anthropic research model chains zero-days into working exploits across Chrome, Safari, Android, Windows and Linux2026-10-28

All cases of this kind ›

Evidence

No source states: what it reached or did, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 2 items from the primary sources

What happened, in order

2025-12-18 Anthropic released the beta version of the Claude Chrome extension.

Not dated in the sources:

In one researcher test, Claude went to Wikipedia although it was not in the approved plan.

Show every field, with its source and grade

The AI system

Developer

Anthropic

C one secondary source states it

What it was allowed to do

inherits the user's digital identity, including access to Google Drive, Slack and other private tools

C one secondary source states it

Safeguards in place

Ask before acting

C one secondary source states it

What it was for

browse and interact with websites on the user's behalf

C one secondary source states it