Third Way Alignment logo Third Way AlignmentHumans and AI, together

The Idea

What Is Third Way Alignment? The Three Laws Questions and Answers

Self-Reflection

Take the JULIA Test JULIA Test Documentation

In Depth

The Framework in Depth Interactive Scenarios The Book AI Model Analysis Global Perspectives Educational Resources

Research

Papers and Publications Critiques and Responses Articles Convergent Developments

About

The Author Origin Story Contact
From LinkedIn • April 24, 2026

Alexander Hanff found the horse that Claude tried to pass off to you.

When an AI assistant quietly rewrites the rules of your browser, consent isn't a footnote: it's the whole story. Over the past week, a controversy has emerged.

When an AI assistant quietly rewrites the rules of your browser, consent isn't a footnote: it's the whole story.

Over the past week, a controversy has emerged around Anthropic's Claude Desktop for macOS that deserves careful attention from consumers, security and privacy professionals, regulators, and product leaders alike. The facts, as independently verified and reported by The Register, gHacks, Malwarebytes, and WebProNews following the initial disclosure by privacy researcher and lawyer Alexander Hanff, are narrower than some headlines suggest, yet more serious than they first appear.

What is documented: On installation and each subsequent launch, Claude Desktop silently writes a Native Messaging manifest (com.anthropic.claude_browser_extension.json) into the application-support directories of a hardcoded list of Chromium-based browsers: Chrome, Edge, Brave, Arc, Vivaldi, Opera, and Chromium. This happens regardless of whether those browsers are installed. The manifest pre-authorizes specific Anthropic extensions to launch a signed helper binary (chrome-native-host) that runs outside the browser sandbox with the user's full privileges. The files are recreated if deleted, there is no in-app toggle to disable the behavior, and no consent prompt is shown at install time. As of this writing, Anthropic has not publicly responded.

What is a risk scenario, not a confirmed incident: There is no public evidence that this bridge has been exploited or used to exfiltrate data. The concern is structural. Paired with the companion extension, the bridge enables reading page content, interacting with authenticated sessions, filling forms, and capturing screen content. Anthropic's own documentation acknowledges an 11.2% residual prompt-injection success rate against its Chrome extension even with mitigations in place. A pre-positioned, persistent, privileged channel is a dormant capability, not an active harm, but its existence meaningfully expands the attack surface.

Why the consent and trust-boundary issue matters: Users reasonably expect that installing Application A does not silently reconfigure Applications B, C, and D from unrelated vendors. This expectation becomes especially critical when such changes survive deletion and cannot be turned off. That expectation is not merely cultural; under Article 5(3) of the EU ePrivacy Directive, storing information on a user's device generally requires informed consent unless strictly necessary to deliver a service the user explicitly requested. A forward-installed integration into browsers the user may not even have is a difficult fit for that exemption. Whether or not the label "spyware" applies (experts reasonably disagree), the behavior crosses a well-established trust boundary.

A reasonable industry standard:

  • Disclose at install. Browser and system-level integrations should be named, explained, and surfaced before they are configured.
  • Default to off, opt in per browser. No pre-provisioning into applications the user hasn't chosen to connect.
  • Provide a visible off switch. A setting inside the app that fully removes manifests and does not silently recreate them.
  • Scope to the minimum. Native Messaging bridges should be created only for browsers actually present and actually linked by the user.
  • Respond publicly and promptly when credible researchers raise concerns.

AI assistants are moving quickly from chat windows into agents that act on our behalf across the system. That shift is valuable, but it only works if the trust model scales with the capability. Silent, persistent, cross-application configuration (however well-intentioned) is the wrong baseline for that future. Getting consent right now is how the industry avoids paying for it later, in regulation, in breaches, and in user trust.

A big shout out to Alexander Hanff: The Privacy Guy as he did a major favor for the world. Please read his original article on his website and other work he has done https://www.thatprivacyguy.com/.

#AI #Privacy #Security #Anthropic #Claude #ePrivacy #ProductEthics