A critical vulnerability in Claude Desktop Extensions enables hackers to silently compromise systems with a single Google Calendar invite.