Analysis Links Claude Browser Bridge, MCP Flaw and Mythos Access Risks

Summary

A ToxSec analysis links Claude Desktop’s browser Native Messaging setup, an MCP STDIO command-execution flaw reported by Ox Security, and alleged month-long access to Anthropic’s Mythos model; it says mass data exfiltration has not been proven.

Key points

The article says Claude Desktop writes a Native Messaging manifest into seven Chromium-based browser profiles on macOS, preauthorizing three Claude extension IDs to connect to a local helper.
It explains that the bridge can reach a local process outside the browser sandbox, but says activation requires a Claude browser extension and a successful prompt injection; no mass data exfiltration has been proven.
The article cites Anthropic figures showing Claude for Chrome prompt-injection success rates of 23.6% without mitigations and 11.2% with current measures.
Ox Security reportedly found that MCP’s STDIO transport can execute a configured command before returning an error; its proof of concept allegedly poisoned 9 of 11 MCP marketplaces.
The article cites Ox Security estimates of up to 200,000 vulnerable instances and says Anthropic considered the behavior expected and declined protocol-level changes.
A Discord group allegedly accessed Anthropic’s Mythos model using contractor credentials and predictable URL patterns after details were exposed in a Mercor breach; the article says a Bloomberg reporter alerted Anthropic.

Article Details

Event Type: Multiple reported AI security incidents and design weaknesses involving Claude Desktop's browser integration, MCP STDIO command execution, and unauthorized access to Anthropic's Mythos model.
Impact: Claude Desktop reportedly installs a Native Messaging bridge and pre-authorizes Claude extension IDs, creating a potential route for prompt-injected browser agents to reach a local helper with user-level privileges; the article says no mass data exfiltration has been documented. Ox Security reported that MCP STDIO behavior can enable arbitrary command execution in vulnerable implementations, estimating up to 200,000 vulnerable instances. A private Discord group reportedly accessed and used Mythos for about a month after guessing its URL pattern; Anthropic was alerted by a Bloomberg reporter.

People

Alexander HanffPrivacy researcher who discovered the Claude Desktop Native Messaging manifest in browser profile directories and reported the finding.David LindnerOf Contrast Security; commented on the possibility that other actors may have accessed Mythos, framing it as a concern rather than a confirmed attribution.Noah KenneyAt Digital 520, described the technical claims about Claude Desktop as testable and reproducible while disputing the spyware label.

Vendors

AnthropicAnthropic’s week of incidents shows a recurring pattern: Claude Desktop silently installs a Native Messaging manifest into seven Chromium-based browser profiles, pre-authorizing extension IDs, while the MCP STDIO design

Products

Claude CodeTL;DR: Claude Code is not spyware. But Claude Desktop quietly drops a Native Messaging bridge into seven browsers without asking.Claude DesktopAnthropic’s week of incidents shows a recurring pattern: Claude Desktop silently installs a Native Messaging manifest into seven Chromium-based browser profiles, pre-authorizing extension IDs, while the MCP STDIO design Claude for ChromeAnthropic’s own published numbers: Claude for Chrome is vulnerable to prompt injection at a 23.6% success rate without mitigations and 11.2% with current measures.Mythosbrowser profiles, pre-authorizing extension IDs, while the MCP STDIO design and a predictable Mythos URL exposed critical supply-chain and access risks.