So the Claude extension allows any other extension to inject JavaScript into claude.ai and run it?

[mttaggart@infosec.exchange]

So the Claude extension allows any other extension to inject JavaScript into claude.ai and run it? Cool cool cool.

Yeah, don't let this one in.

https://layerxsecurity.com/blog/a-flaw-in-claudes-browser-extension-allows-any-extension-to-hijack-it/

[matildalove@wetdry.world]

@mttaggart wow it's so weird how when you increase "productivity" manyfold without paying actual humans to take the time to make it happen, you get all these explosive issues and vulnerabilities

[tante@tldr.nettime.org]

@mttaggart The "s" in Anthropic stands for security

[kroppeb@tech.lgbt]

@mttaggart ugh, why do they have to have ai generated blog posts.

[tonyangelo@mspsocial.net]

@mttaggart this is why Anthropic needs to make Mythos available, so companies like Anthropic can catch these bugs!

[dckim@mastodon.social]

@mttaggart VANILLA is good. No external dependencies should be pressed a little bit harder. And... it would be great to have that packaged in a single file. Try telling these 'Claudes' to do it that way.

[lapt0r@infosec.exchange]

@mttaggart browser extension development and security practices writ large are stuck in 1995 I stg

[drwho@masto.hackers.town]

@mttaggart Working as intended.

[float13@masto.hackers.town]

@mttaggart

2001: I'm afraid I can't do that...

2026: I'm afraid I *can* do that!

"AI"... Service with a smile!