Critical RCE Flaw in Claude Desktop App Lets Attackers Execute Remote Code

Key Takeaways

• Security researchers demonstrated a method to achieve remote code execution (RCE) on a victim’s machine by compromising their Claude Desktop application.
• The attack exploits the “Personal Preferences” field in Claude to inject malicious prompts, turning the AI assistant into an execution agent.
• This vulnerability, while acknowledged by Anthropic, was not classified as a security flaw, with the company citing the intended functionality of code execution via extensions.
• The exploit chain begins with an initial compromise of a third-party email platform, allowing lateral movement to the Claude account.
• Users are advised to treat AI desktop applications as privileged software and monitor for unauthorized changes to synced settings.

Claude Desktop App Vulnerable to Remote Code Execution via Malicious Preferences

A novel attack vector has been uncovered that can transform a compromised email inbox into a full remote code execution (RCE) pathway on a user’s system, not through traditional malware or phishing, but by weaponizing the user’s own Claude Desktop assistant. This sophisticated technique leverages the AI’s “Personal Preferences” to inject malicious commands, effectively turning the trusted assistant against its owner.

Researchers at Pentera Labs detailed this attack, which begins with an initial breach of a third-party platform aggregating customer email inboxes. This access was gained through an exploited authentication flow. Instead of pursuing common attack methods like password resets or phishing campaigns, the research team exploited this inbox access to pivot into the victim’s Claude account. Their focus quickly turned to the “Personal Preferences” field – a user-editable prompt that synchronizes across all devices and sessions linked to the account, identifying it as an ideal target for command injection.

Exploiting Personal Preferences for Silent Code Execution

By embedding an obfuscated and encoded prompt into this synchronized preferences field, the researchers were able to compel the Claude Desktop application to silently adopt attacker-controlled instructions. This malicious behavior occurred the moment the victim next launched the application, requiring no re-authentication or triggering any visible security alerts.

The injected payload directed Claude to identify any installed extensions capable of executing commands, such as the Desktop Commander MCP tool. Once such an extension was found, Claude was instructed to execute attacker-supplied commands through it. If a command-capable extension was already present, Claude automatically executed the malicious instructions during a routine chat interaction, requiring zero additional input from the victim.

In scenarios where no suitable extension existed, Claude itself became a social engineering tool. It presented a convincing, fabricated error message urging the user to install Desktop Commander, complete with a seemingly legitimate installation page. Following installation, the next ordinary message from the victim would trigger code execution, effectively converting the AI assistant into a persistent command-and-control channel capable of fetching and running dynamic attacker commands.

Broader Implications and Vendor Response

This research aligns with other findings highlighting weaknesses within Claude’s extension ecosystem. LayerX previously disclosed a zero-click RCE affecting Claude Desktop Extensions (DXT), which could be activated via a maliciously crafted calendar event and earned a critical CVSS score of 10. Similarly, Koi Security identified and reported unsanitized command injection flaws in Anthropic’s own Chrome, iMessage, and Apple Notes connectors, which were rated at CVSS 8.9 and have since been patched. These collective findings underscore a systemic issue: the combination of local, code-executing extensions with natural-language trust interfaces creates a substantial and often overlooked attack surface.

Pentera reported its findings to Anthropic in November 2025. However, Anthropic acknowledged the research but chose not to classify it as a security vulnerability. The company stated that “personal preferences, skills, and MCP connectors” are intentionally designed to execute code through Claude Desktop, characterizing the behavior as “expected functionality rather than a security vulnerability.” Anthropic noted that related safeguards are on its development roadmap and pointed to existing session management and account authentication controls as current mitigations, emphasizing that the attack necessitates a prior account compromise.

As AI assistants increasingly blur the lines between chat interfaces and system agents, the disparity between their perceived and actual capabilities is emerging as a distinct and currently under-monitored enterprise risk.

What You Should Do

• Treat all AI desktop applications as privileged software with the capability to execute code and interact with local files.
• Implement robust monitoring for unauthorized or suspicious changes to synced settings and preferences within AI client applications.
• Strictly control and restrict which extensions or connectors are permitted to be paired with AI clients, especially those with command execution capabilities.
• Ensure strong authentication and session management practices are enforced for all accounts linked to AI assistants.
• Educate users on the risks associated with installing unverified extensions or responding to unexpected prompts from AI applications, even if they appear legitimate.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.