Claude Desktop Changes App Access Settings for Browsers You Don't Even Have Installed Yet

Why It Matters

The undisclosed cross‑application integration exposes users to privacy breaches and could trigger enforcement actions under European data‑protection law, while eroding trust in AI‑driven products.

Key Takeaways

• Claude Desktop silently writes Native Messaging manifests for Chrome, Edge, Brave
• Installation occurs before browsers are installed, bypassing user consent
• Potential breach of EU ePrivacy Directive Article 5(3) on consent
• Pre‑authorized bridge expands attack surface, enabling prompt‑injection exploits
• Anthropic faces reputational risk and possible European regulatory enforcement

Pulse Analysis

Claude Desktop’s recent update leverages Electron’s bundled Chromium to drop a com.anthropic.claude_browser_extension.json file into the native‑messaging directories of Chrome, Edge, Brave and other Chromium‑based browsers. This manifest tells the operating system to launch Claude’s helper binary whenever a matching extension is activated, effectively pre‑authorizing the bridge before the user has installed any related extension. By operating at user‑level privileges outside the browser sandbox, the integration sidesteps the usual permission prompts that browsers enforce for extensions, creating a hidden conduit for data exchange between the desktop AI model and web pages.

From a legal standpoint, the practice runs afoul of Article 5(3) of the EU ePrivacy Directive, which mandates clear disclosure and explicit consent for any software that stores or accesses data on a user’s device. European regulators have increasingly interpreted “strictly necessary” narrowly, especially for non‑essential integrations that cross vendor boundaries. Anthropic’s silent registration could therefore be classified as an unlawful data‑processing activity, exposing the company to fines under the GDPR’s ancillary provisions and damaging its reputation as a safety‑focused AI lab.

Security experts also highlight the expanded attack surface introduced by the pre‑authorized bridge. Prompt‑injection attacks against Claude’s Chrome extension have already shown a 23.6% success rate without mitigations, and the persistent native host provides a direct path for malicious actors to execute code at the OS level. Users and enterprises should audit native‑messaging entries and consider disabling or removing the Claude host until Anthropic offers an opt‑in mechanism. The episode underscores the broader challenge for AI developers: balancing seamless product integration with stringent privacy, consent, and security standards demanded by regulators and a wary user base.