🎯Basically, a researcher says Claude Desktop secretly installs software that could spy on users' web activities.
What Happened
A security researcher, Alexander Hanff, has raised serious concerns about Claude Desktop, an application developed by Anthropic. In his article, he claims that installing Claude Desktop on macOS results in the installation of what he describes as spyware. This claim has sparked discussions among users on platforms like Mastodon and Reddit, with many supporting his findings.
The Findings
During his investigation, Hanff discovered a Native Messaging host manifest on his Mac that he did not knowingly install. This manifest allows Chromium-based browsers (like Chrome, Edge, and Brave) to communicate with native applications outside the browser's sandbox. Hanff's tests revealed that installing Claude Desktop automatically drops this manifest into multiple browser profiles, even those not yet installed on the system.
The manifest pre-authorizes three Chrome extension IDs, allowing any extension with those IDs to access the native host. This access could enable browser automation features, raising significant privacy concerns. Hanff argues that this behavior effectively acts as a backdoor, expanding the attack surface of any machine where the manifest is installed.
Implications for Users
While Native Messaging is a standard mechanism in Chromium, the way Claude Desktop utilizes it raises ethical questions. Users may not be aware that the application is modifying their browser configurations without consent. Hanff emphasizes that while the bridge created by the manifest does not perform any malicious actions on its own, it has the potential to be exploited.
What’s Next?
Currently, there is no official response from Anthropic regarding these claims. The lack of a detailed technical privacy specification for the Claude Desktop-browser integration leaves many questions unanswered. Users are left in the dark about what data might flow when using this integration.
Conclusion
The situation highlights a growing concern about user privacy in software applications. While Claude Desktop may aim to enhance functionality across browsers, the method of silently installing a manifest raises ethical issues. Users deserve transparency regarding how applications interact with their systems, allowing them to make informed decisions about the risks involved.
🔒 Pro insight: The silent installation of Native Messaging manifests could set a concerning precedent for user privacy and consent in software applications.
