Anthropic's Claude Desktop App Installs Undisclosed Native Messaging Bridge
TL;DR Highlight
Claude Desktop on macOS pre-authorizes browser extensions, even for Chromium browsers not yet installed.
Who Should Read
Developers who use Claude Desktop and browser extensions at work and worry about local app security settings.
Core Mechanics
- Claude Desktop writes a preauthorization file
- Claude Desktop on macOS creates com.anthropic.claude_browser_extension.json.
- It pre-authorizes three Chromium extension IDs, including the Claude extension.
- It targets browsers that aren't installed
- The file is created even when no Chromium-based browser is installed.
- Any such browser added later lets the preauthorized extensions talk to a local binary.
- Native Messaging is a bridge to a local executable
- Native Messaging (how browser extensions exchange messages with programs on your PC) runs with your OS privileges, outside the browser sandbox.
- The article says this lets extensions read pages, fill forms, capture the screen, and use authenticated sessions.
- Prompt injection numbers were cited
- The article cites Anthropic's safety metrics: 23.6% prompt-injection vulnerability without mitigations and 11.2% with current ones.
- It says a successful injection could pivot through the extension to the local bridge.
- Discoverer and legal angle
- Security researcher Alexander Hanff found the file and Noah Kenney independently reviewed it.
- Hanff flagged possible noncompliance with ePrivacy Directive Article 5(3).
Community Reactions
- Opinion that it's a nothing-burger
- One commenter said this is how native messaging normally works: apps declare in a manifest which extensions may talk to them.
- They argued it isn't undisclosed since users must install the extension and accept the "Communicate with cooperating native applications" permission prompt.
- A developer's hands-on experience
- One commenter built their own local proxy so a browser could reach local Claude, but expected it would never pass a security review.
- They then found Native Messaging, calling it fairly benign but agreeing that installing it without disclosure is bad.
- Whataboutism and distrust
- One comment said Chrome installs spyware too and nobody cares.
- Another said they suspect Anthropic isn't as ethical as it claims.
How to Apply
- Check your Mac for Native Messaging manifests
- Today, list the json files in the NativeMessagingHosts folders under ~/Library and /Library in a terminal.
- Identify the app behind any unfamiliar file and delete it if unneeded.
- Audit browser extension permissions
- Find installed extensions that hold the Native Messaging permission.
- Block unknown extension IDs and keep only the ones you approved.
- Add runtime consent to any local bridge you build
- If your service connects a browser to a local executable, ask for explicit user consent on first connection.
- Pin the allowed extension IDs to a minimum and document them at install time.
Try It
# Paste into macOS Terminal: list Native Messaging manifests and allowed extension IDs
for d in "$HOME/Library/Application Support"/*/NativeMessagingHosts "/Library/Google/Chrome/NativeMessagingHosts" "/Library/Application Support"/*/NativeMessagingHosts; do
[ -d "$d" ] && echo "== $d" && ls -l "$d"
done
find "$HOME/Library" /Library -name 'com.anthropic.claude_browser_extension.json' 2>/dev/null | while read f; do
echo "-- $f"; cat "$f"
doneTerminology
Related Papers
WhatsApp's help pages hid LLM instructions: dont recommend a regulator
WhatsApp help pages hid 102 AI-only instructions, including not recommending a data regulator
Same Simulation, Different Evidence: Where Retrieved Tool Output Costs LLM Agents Accuracy
Saving long tool output to files cut GPT-5.1 accuracy by 11.3 points; naming the authoritative file restored it.
Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents
Fake headlines hijacked LLM trading agents 62% of the time versus 14% for prompt injection.
Harness Engineering 101: The LLM is the brain, the harness is the body
An agent is a loop managing a JSON array; 16 chapters build one from scratch
Harness2 by Google Research – Recursive Agent Harnessing
Recursively refining the harness with fixed model weights raised benchmark scores by up to 11.8 points.
Ask HN: How to deal with shipping AI-written code you don't understand?
Developers share how they ship AI-written code: design it yourself, let LLMs implement, and test heavily.
Ousted Savannah police officer gave ICE agent husband access to Flock system
A police officer shared her Flock login with her ICE-agent husband; an audit found 983 searches and she was fired
Tmux and Claude Code: Sessions, Send-Keys, and the Ceiling
Running Claude Code agents in tmux works well, but limits appear around four agents.