I've been seeing this extension all over and wasn't sure exactly what folks were doing.

[mttaggart@infosec.exchange]

I've been seeing this extension all over and wasn't sure exactly what folks were doing. Turns out, they weren't doing anything. Claude for Desktop is secretly installing this thing that activates when one of three other extensions are also present.

https://www.thatprivacyguy.com/blog/anthropic-spyware/

[mttaggart@infosec.exchange]

Two of the listed IDs are private (or I couldn't find them in Chrome/Edge), and one is official Claude extension.

[stepheneb@ruby.social]

@mttaggart

Wow, that’s nasty. thatprivacyguy’s (Alexander Hanff) report is quite thorough.

[ukeleleeric@mstdn.social]

@mttaggart Just shows how much (little) you can trust these AI companies.

[catbailey@infosec.space]

@mttaggart So if for some reason you want to install the thing, either a VM or dedicated and isolated terminal sounds like the way to go.

[qurlyjoe@mstdn.social]

@mttaggart
Probably a silly question: is that legal/ethical?

[mttaggart@infosec.exchange]

@qurlyjoe Ethical: no. Legal, almost certainly.

[qurlyjoe@mstdn.social]

@mttaggart
A long tradition.

[mttaggart@infosec.exchange]

@catbailey Honestly, if you intend to use this with your browser, no OS isolation is going to help you. The purpose here is to give Claude Desktop direct access to whatever you're logged into in browsers that have these 3 extensions.

And if you're already trying to use Claude with your personal data that way, welp