Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-03-10 · source-backed
LayerX disclosed that DXT extensions run unsandboxed with full system privileges. An attacker can craft a malicious calendar event that chains a low-risk connector to a high-risk local executor — achieving full RCE without any user click. Anthropic reportedly declined to fix, saying it "falls outside our current threat model." Before installing any DXT or MCP extension, audit its permission scope. Infosecurity Magazine | LayerX
Each link below shares sources, entities, or timing with this story.
Anthropic released MCP / Shared entities / Same source / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, Click RCE, CVSS, DXT; cite the same source (LayerX).
Anthropic released MCP / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, CVSS, MCP, RCE; overlapping topics (chain, full).
OX Security criticizes MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (OX Security criticizes MCP); both cover Anthropic, CVSS, MCP, RCE; overlapping topics (anthropic, audit, cvss).
OpenAI supports MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (OpenAI supports MCP); both cover Anthropic, CVSS, RCE; overlapping topics (anthropic, attacker, cvss).
Anthropic released MCP / Shared entities / Same source domain / What happened next
Linked by a graph relationship (Anthropic released MCP); both cover CVSS, Infosecurity Magazine, MCP; reported by the same outlet (infosecurity-magazine.com).
Claude Code uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses MCP); both cover CVSS, MCP, RCE; overlapping topics (audit, chain).
Anthropic released MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, MCP, RCE; overlapping topics (anthropic, audit).
Linked by a graph relationship (Anthropic released MCP); both cover Anthropic, MCP, RCE; overlapping topics (anthropic, audit).