Akamai acquired LayerX. This previously published blog post reflects the product and feature names on the original date of publication.

Summary:

LayerX discovered a zero-click remote code execution (RCE) vulnerability in Claude Desktop Extensions (DXT) , in which a single Google Calendar event can silently compromise a system running Claude Desktop Extensions. The flaw impacts more than 10,000 active users and 50 DXT extensions. 

\r\n Unlike traditional browser extensions, Claude Desktop Extensions run unsandboxed with full system privileges. As a result, Claude can autonomously chain low-risk connectors (e.g., Google Calendar) to high-risk local executors, without user awareness or consent. If exploited by a bad actor, even a benign prompt (“take care of it”), coupled with a maliciously worded calendar event, is sufficient to trigger arbitrary local code execution that compromises the entire system. 

\r\n This vulnerability earned a CVSS 10/10.…