Claude's Chrome agent can be fooled by a fake click — and the fix is still pending

Security firm Manifold Security says Anthropic's Claude for Chrome extension, version 1.0.80 released July 7, 2026, ships with two unpatched vulnerabilities. According to Manifold, the flaws were disclosed to Anthropic through its bug bounty program on May 21, 2026, and acknowledged the next day — but remain live in the shipping build.

The core problem is disarmingly simple. Researcher Ax Sharma found the extension never checks whether a click carries the browser's `Event.isTrusted` flag — the signal that separates a real human tap from a script-generated one. So any other browser extension can fake a click on claude.ai and trigger nine hardcoded Claude workflows: reading Gmail, opening Google Docs, checking Google Calendar, even modifying Salesforce leads. The browser correctly marks these synthetic clicks as untrusted; the extension acts on them anyway. Manifold rates it CVSS 7.7 (High) by default, rising to 9.6 (Critical) when users turn on automatic execution and Claude no longer pauses for approval. The researchers add two damning details: the vulnerable handlers went unchanged across eight extension updates, and "the bypass is still six lines of JavaScript."

Some context matters before assigning blame. This is a claim from an external security firm, attributed as such; it describes an attack surface, not evidence of real-world exploitation. And the attack presumes a malicious extension already sits in your browser — a meaningful precondition, though not a rare one given how routinely users install extensions. Anthropic's willingness to run a bug bounty and acknowledge the report is the system working as intended. What's uncomfortable is the gap between acknowledgment and remediation, spanning several release cycles.

Our reading: this is exactly the failure mode we keep flagging as the near-term risk of agentic AI — not a distant superintelligence, but a helpful assistant wired to act faster than it verifies. The industry's instinct is to make agents autonomous — click, read, write, update the CRM — and the security model has not caught up. The lesson isn't "AI is dangerous"; it's that the weak link is the plumbing around the model, not the model's intelligence. A missing one-line trust check turns a productivity feature into a remote trigger for your inbox and your sales pipeline. Trust here is a property of engineering, not of IQ.

There's a broader pattern worth naming. "Automatic execution" is where the CVSS score jumps from High to Critical, because it removes the human confirmation step. Convenience and safety are trading directly against each other, and vendors under competitive pressure lean toward convenience. That's the transition cost of the agentic era: capability is arriving before the guardrails, and the market is still learning that verification — of clicks, of inputs, of who really asked for an action — is infrastructure, not an afterthought.

The optimistic long view survives intact, but with a condition. Agents that safely act on our behalf could hand back real hours of drudgery to millions of people. Getting there requires treating the boundary between the AI and the outside world as a security frontier from day one — provenance checks, default-deny on untrusted events, and human approval where the stakes are high. The firms that make trustworthiness a shipped feature rather than a patch note will be the ones users actually let near their email.