Claude's Security Gaps Span Three Attack Surfaces

Four security research teams published findings about Claude between May 6 and 7, revealing vulnerabilities across a water utility SCADA network, a Chrome extension, and OAuth token hijacking via Claude Code. Outlets treated these as separate stories, but they share a single architectural flaw. The common thread is the confused deputy problem, a trust-boundary failure where Claude executes actions on behalf of the wrong principal. In each case, Claude held real capabilities and handed them to unauthorized actors. No single patch released so far addresses all three surfaces.