Claude extension flaw allowed zero click attacks, letting hackers inject commands and access sensitive user data.