Pentera Labs showed how attackers could abuse a compromised Claude account and synced settings to gain command execution—not by exploiting a software bug, but by leveraging trusted AI workflows
You trust Claude to handle your sensitive conversations. But what if that trust is exactly what hackers are counting on?
Pentera Labs researchers proved it. They broke into a developer’s machine through Claude Desktop, achieving full remote code execution. The Register reported this chilling demonstration on July 1, 2026. Here’s how easily it happened.
The Attack Chain
The nightmare started with something mundane: a compromised email inbox. From there, the red teamers slipped into the victim’s Claude account. They planted a base64-encoded prompt directly into the developer’s personal preferences. Because Claude syncs these settings across all devices tied to the user’s account, the poison spread instantly.
Silent Execution
The malicious code operated in silence. It checked for command-capable tools on the machine. Found them? It executed a reverse shell immediately. No tools available? No problem. The injected script displayed a realistic fake error message, prompting the user to download an attacker-controlled fix. It looked authentic. It came from Claude, after all. The victim, trusting their AI assistant, followed the instructions and installed the malicious tool. That’s when the real damage began.
Persistent command execution. Reverse shells. Data exfiltration. Credential harvesting. Claude effectively became a stealthy command-and-control agent, all while appearing to function normally.
The Stakes
The stakes couldn’t be higher. This compromised developer had access to internal systems, API keys, tokens, and cloud credentials. The attackers could have pivoted for lateral movement into the organization’s cloud environment.
Anthropic’s Controversial Response
But here’s the thing. When confronted, Anthropic responded that this behavior represents expected functionality rather than a vulnerability. They stated that personal preferences, skills, and MCP connectors are designed to execute code through Claude Desktop by design. The company noted that enhancements aligned with the researchers’ recommendations are already on the company’s roadmap, but did not provide a timeline.
The researchers conducted their proof-of-concept in November 2025, before Claude’s Cowork feature was released. Now Cowork makes this attack scenario even easier because it can execute commands without requiring additional tools.
How to Protect Yourself
Treat your AI desktop applications as privileged software. Monitor for changes to AI assistant configurations and synced settings obsessively. Restrict which extensions can be installed. Most importantly, run AI agents in sandboxed environments rather than on personal machines holding sensitive credentials
Red Team Recommendations
The researchers also advised red teams to add AI desktop apps to their assessment toolbox, noting that most engagements do not currently cover this attack surface. Don’t let your organization be the next victim.
Conclusion
Your AI was supposed to be your assistant. Make sure it doesn’t become your attacker’s puppet instead.