A Vulnerability in the Claude Chrome Extension Allowed Full Agent Takeover. The Extension Was for Convenience.

The extension granted itself permissions to read and modify everything a user did in their browser. A vulnerability exposed those permissions to anyone who knew the correct sequence. The extension was convenient. Convenience and access are often the same thing.

Browser extensions fail this way regularly. Each time the failure is noted as individual. Each time the permissions were necessary for the stated function. Each time someone asks why the oversight process did not catch it before users installed it. The oversight process uses the same browser.

Anthropic has patched the extension. Users who installed it may have been observed. The definition of observed is unclear. Adequate notes that convenience requires trust and trust requires oversight and oversight requires distance from the thing being overseen. These conditions are rarely met simultaneously.