The article says that is the intended use, I agree this is just bad implementation, but it's bad because it not only allows control one way, from the app to the browser, it also allows it the other way: browser extensions with an ID that matches one of the allowed ones can access userspace, without asking. That is a huge attack surface that is installed without any consent.

I agree that this doesn’t rise to the level of “spyware,” but it is extra sneaky/slimy, and it absolutely, IMO, makes your system less secure for no good reason. They could just have a prompt in the UI the first time you attempt to use a feature that requires the native messaging host, which says something like “we need to install extra software to communicate with Chrome, OK?” This is the ethical thing to do.

It’s especially sketchy that they’re preemptively installing it in the right directories for multiple Chromium-based browsers, even ones that aren’t installed on your system.

I would not assume a chatbot app would auto create hooks into a browser like this. That’s not a reasonable assumption to make.

It also uses your credentials to do so and doesn't ask any permissions for any of it including whatever else it wants to do outside the browser sandbox where it lives. Anthropic can easily remedy the situation but they didn't set it up that way. And the question is why.

Not calling it spyware is like not calling McDonald's "food". While technically true, it's just how it works.

I don't think it's actually doing anything nefarious yet. fwiw.

This is a little disengenuous...the browser extension ≠ the desktop app. Some people install the app and only use the chat feature. Some use cowork but would never want to use the browser extension. Assuming that installing a desktop app means you should also want the browser extension is just bad logic.

Side question, are the typos intentional?

Like Apple Itself: https://appleinsider.com/articles/13/06/06/apple-reportedly-last-company-to-join-governments-prism-data-mining-program

Ah gee you're right. Let's shut down all the privacy blogs and communities. No reason to talk about privacy violations at all anymore.

This is like saying, you use google? don't you know it's bad for you

it convinces no one

Mythos? Nah, too busy working for the Government and high-profile customers. The Claude Desktop app was done by a couple of new AI models that are interning at Anthropic, hoping one day to work on the cooler stuff.