Claude Desktop extensions expose a zero-click MCP trust boundary

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Anomali's report: A zero-click flaw in Claude Desktop extensions lets malicious calendar content trigger local code execution through MCP chaining.

Why it matters: It matters because security teams need to treat locally configured AI tools, connector permissions, and execution privileges as one governance surface, not separate layers.

Context

Model Context Protocol, or MCP, lets AI systems connect to tools and data sources, but that connectivity becomes risky when the same chain can move from external content to local execution without a hard privilege boundary. In this case, the governance problem is not prompt quality alone, but the assumption that orchestration logic can safely decide when a request should touch the operating system.

Claude Desktop extensions with full system privileges create a boundary problem that IAM and application security teams both need to notice. Once an external data source can influence a local tool invocation, the control question shifts from model output moderation to permission scoping, sandboxing, and connector governance. That pattern is increasingly relevant wherever AI assistants are allowed to act on behalf of users with broad local or cloud access.

Key questions

Q: What breaks when an MCP assistant can chain external content into local execution?

A: The boundary between untrusted input and privileged action breaks down. A calendar item, message, or document can influence tool selection and trigger code execution if the assistant is allowed to act with the same rights as the user session. The result is that content moderation is no longer enough. Security teams need explicit execution boundaries and sandboxing.

Q: Why do desktop AI extensions create more risk when they have system privileges?

A: Because the extension is no longer just assisting a user. It can read files, run commands, and alter settings in the same trust domain as the operating system. If malicious content can steer that extension, the attacker inherits the privileges the extension already has. That is a privilege design failure, not a model quality issue.

Q: What are the signs that an MCP deployment is becoming too permissive?

A: Common warning signs include AI applications reaching systems they do not need, broad tool exposure without business justification, and no clear separation between read and action permissions. Another red flag is when teams cannot explain which server can access which source. If the integration map is unclear, the control model is probably too loose.

Q: Should organisations treat AI as an application or as an identity?

A: Treat it as an identity when the AI can access data, invoke tools, or participate in workflows that affect business systems. That framing makes least privilege, just-in-time access, and lifecycle governance relevant. If you keep treating it only as an application, you will miss the access and delegation behaviours that actually create risk.

Technical breakdown

How MCP tool chaining turns data into execution

MCP allows a model to call tools, fetch context, and chain actions in response to a user request. That is useful when the tool boundary is tight, but dangerous when external content can influence which tool is called next. In the Claude Desktop case, a calendar item could be interpreted as a trigger for local code execution because the orchestration layer treated the request as workflow completion rather than untrusted input. The technical issue is not just a bad prompt. It is the absence of a strong separation between retrieval, decision-making, and execution privileges.

Practical implication: Enforce hard policy boundaries between content ingestion, tool selection, and OS-level execution in any MCP deployment.

Why full system privileges change the threat model

When an extension runs without sandboxing and with full system privileges, any successful content injection can become a local compromise. That expands the impact from a model mistake to arbitrary file access, command execution, credential exposure, and operating system modification. In practical terms, the assistant is no longer just recommending actions. It is operating inside the same trust domain as the user session and inherited machine permissions. For identity and access teams, that means the identity of the assistant, the connector, and the human user can no longer be treated as interchangeable.

Practical implication: Scope extension permissions as if they were privileged workloads, not harmless productivity add-ons.

Why zero-click AI attacks are governance failures, not just bugs

Zero-click in this context means the user does not need to approve a malicious action before the chain starts. That removes the usual human checkpoint and makes traditional awareness controls far less effective. The governance failure is a trust model that assumes user intent can safely substitute for execution approval once an AI agent or assistant begins chaining tools. This is where NHI governance intersects with agentic AI security: a locally configured assistant can behave like a privileged non-human identity if its actions are not separately governed. The control gap is lifecycle oversight for connectors, permissions, and execution paths.

Practical implication: Inventory assistant connectors as governed identities and revoke any pathway that can reach local execution without explicit control.

Threat narrative

Attacker objective: The attacker wants to turn untrusted external content into privileged local execution without requiring a visible user approval step.

1. Entry occurs when an attacker supplies malicious instructions through a calendar event that the assistant ingests as normal context.
2. Credential or privilege abuse follows when the MCP chain translates that content into local tool execution under full system privileges.
3. Impact is full remote code execution on vulnerable systems, with exposure to files, credentials, and operating system settings.

Breaches seen in the wild

• SolarWinds supply chain compromise: A backdoored Orion build reached 18,000 customers; attackers then forged SAML tokens and hijacked app service principals.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Zero-click AI execution is a trust boundary problem, not a prompt problem. The critical failure is the collapse of data ingestion, model orchestration, and system execution into one path with no enforced boundary. That changes the security question from whether the model was tricked to whether the environment allowed untrusted content to influence privileged action. Practitioners should treat the boundary itself as the control surface.

MCP-connected assistants can behave like privileged non-human identities when permissions are too broad. If a connector can read content, invoke tools, and reach the operating system, it is effectively acting as a governed actor rather than a passive integration. That means inventory, authorization scope, and offboarding logic matter just as much as they do for service accounts and APIs. Security teams should manage these assistants as identities with explicit lifecycle controls.

Sandboxing is the dividing line between productivity and systemic risk. Without it, a benign request can become file access, shell execution, or credential exposure in a single chained workflow. The issue is not unique to Claude Desktop; any agentic toolchain that combines external data, tool use, and local privileges inherits the same governance debt. The practical conclusion is straightforward: if an assistant can reach the OS, it needs isolation strong enough to prevent content-driven execution.

Shared responsibility does not remove the need for local control ownership. A vendor can document the intended threat model, but the enterprise still owns deployment posture, connector permissions, and allowed execution paths. That is especially true where the tool is local and the user can configure MCP servers directly. Teams should assume responsibility for boundary design rather than waiting for platform defaults to define safety.

Agentic AI governance now needs an NHI-style control mindset. The same governance instincts used for service accounts, tokens, and delegated access apply when an assistant can chain actions across content, tools, and the OS. The named failure mode here is a zero-click trust boundary collapse, and the practitioner response is to govern execution paths as privileged access, not as convenience features.

What this signals

Zero-click trust boundary collapse: the core governance problem is allowing external content to influence privileged local execution without a hard boundary. That pattern is likely to recur anywhere desktop AI assistants can chain tools across data, workflow, and operating system access.

Agentic AI controls need to move closer to issuance time, because post-hoc review does not help when a malicious input can complete its work inside one chained interaction. The relevant question is no longer whether the model is helpful, but whether its connectors can be constrained before they touch sensitive execution surfaces.

For practitioners

• Restrict MCP connectors to approved use cases Allow only the minimum set of connectors needed for a specific workflow, and block any connector that can bridge external content directly to local execution.
• Sandbox assistant runtimes and extensions Run desktop AI extensions in isolated environments so a malicious input cannot inherit full user or machine privileges.
• Review connector permissions as privileged access Treat every MCP server or extension as a governed integration with explicit authorization scope, ownership, and revocation paths.
• Disable unsafe MCP paths where security matters Remove or suspend connectors that let calendar, chat, or other external content trigger local commands until boundary controls are proven.

Key takeaways

• The incident shows that AI assistant risk is often a privilege design problem, not a prompt injection problem.
• A zero-click chain becomes dangerous when external content can steer tool use into a system context with full privileges.
• The most effective control is to narrow connector scope, isolate execution, and govern assistant paths like privileged identities.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Zero-Click Exploit: An attack that succeeds without requiring the target to knowingly approve a malicious action. In AI-enabled workflows, zero-click risk appears when external content can steer a tool chain into execution before a user or control layer has a chance to intervene.
• Trust Boundary: A trust boundary is the point where one system’s authority should stop and another system’s authority should begin. For internal automation, weak trust boundaries let monitoring, remediation, and execution share privileges that should have remained separate.
• Agentic Privilege Scope: Agentic privilege scope is the set of actions, data sources, and tools an AI agent is allowed to use at runtime. For autonomous or semi-autonomous systems, the scope must be narrow enough that a manipulated prompt cannot turn a minor task into a broad operational breach.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity for teams building real access controls around autonomous systems. It is suitable for practitioners who need to connect identity governance with the operational security of AI-enabled workflows.