Claude Desktop and the Silent Modification to the System: What Anthropic Installs Without Telling You
The installation of the application Claude Desktop on the system brings something that is not entirely transparent: according to documentation by privacy researcher Alexander Hanff and the blog That Privacy Guy, the installation process silently registers a Native Messaging bridge in seven Chromium-based browsers, without any notification to the user and without requiring explicit consent. The most concerning detail is that the bridge is also written into the profiles of browsers not listed in Anthropic's official documentation and even in browsers not installed on the system at the time of installation, essentially preparing a potential communication channel for future use.
Technically, Chromium Native Messaging is a legitimate API that allows a browser extension to communicate with a native application on the desktop via stdin/stdout, without exposing external network traffic. This is the same mechanism used by password managers like Bitwarden or development tools to establish a local channel between the browser and the installed software. The issue raised is therefore not the technology itself, but the fact that Anthropic installs it without any prior notification: the user is not warned that Claude Desktop will register Native Messaging manifests in the configuration paths of Chrome, Chromium, Brave, Edge, Opera, Vivaldi, and other compatible browsers.
What the Bridge Actually Does
Once registered, the Native Messaging manifest informs the interested browsers that there is a native host (com.anthropic.claude_browser_extension) available for communication. This host is the component that allows Claude in Chrome, Anthropic's official extension, to connect to the desktop application and enable advanced functionalities such as autonomous browsing, reading page content, executing JavaScript, and interacting with forms. Without the bridge, the extension operates in a reduced mode; with the bridge active, Claude gains significant browser automation capabilities, including access to login sessions and stored data from the browser for visited sites.
The critical point is not that these functionalities exist, but that the channel is opened unilaterally before the user even installs or activates the browser extension. In practice, anyone installing Claude Desktop finds the Native Messaging paths already populated, regardless of their intention to use the browser integration. On macOS, the manifest is written in ~/Library/Application Support/[Browser]/NativeMessagingHosts/; on Windows, a registry key is created under HKCU\SOFTWARE\Google\Chrome\NativeMessagingHosts/.
The Expanded Security Context
The news comes at a time when trust in the AI browser extensions ecosystem is already under pressure: in December 2025, a zero-click vulnerability was discovered in the official Claude extension for Chrome, which accepted communications from any origin. An attacker could inject invisible prompts, steal Google OAuth tokens, and access conversation history simply by inducing the victim to visit a malicious page. Anthropic released a patch on January 15, 2026, replacing the wildcard with an origin check.
In March 2026, Koi Security documented ShadowPrompt, a new zero-click flaw in the Claude Code extension for Chrome: the bug exploited an XSS on a subdomain a-cdn.claude.ai to execute arbitrary code in the context of the extension, without any user interaction. Anthropic patched this in version 1.0.41. At the same time, in February 2026, LayerX reported that 50 Claude Desktop Extensions (DXT) were vulnerable to remote code execution through a single Google Calendar event, with the substantial difference compared to traditional browser extensions that DXT runs without sandboxing and with full privileges on the host system.
The overall picture is that of a vendor that has rapidly expanded the capabilities of integration among AI, desktop, and browsers, accumulating considerable attack surface, and has not always communicated transparently the implications of these architectural choices to end-users. The silent registration of the Native Messaging bridge is, in this sense, consistent with a broader pattern: powerful functionalities installed opaquely and made available without the user being aware of them.
Can It Be Considered Spyware?
Online, the debate is open: on Reddit and in various vertical communities, several users have defended Anthropic, emphasizing that the Native Messaging bridge itself does not transmit data to any server and that its use still requires the user to install and activate the browser extension separately. From this perspective, it could be considered a questionable behavior in terms of UX and transparency, rather than active surveillance. The opposing argument is that the installation occurs without disclosure, in unsupported and unrequested browsers, preparing infrastructure that the user did not choose to have. The term "spyware" is probably excessive on a technical-legal level, but the behavior touches on sensitive aspects of consent and digital autonomy that Anthropic cannot afford to ignore, especially after positioning itself as a company focused on AI security.
There is still no official public response from Anthropic regarding the installation of the bridge in unsupported and uninstalled browsers. The official documentation describes Native Messaging as part of the Claude in Chrome integration, but does not explicitly mention that the manifest is registered during the installation of Claude Desktop regardless of using the extension.