Claude Desktop does install browser integration code into multiple Chromium browsers without explicit disclosure of scope—a real architectural design flaw that creates potential attack vectors through browser extensions. But calling it 'spyware' is technically wrong; it's an undisclosed native messaging bridge that could enable prompt injection attacks, not active data exfiltration. The headline inflames the issue rather than clarifying that this is a security vulnerability in Claude's design requiring multiple attack chains to actually compromise a user.