Claude Dispatch flaw lets browser extensions run code on desktops, researcher says

A vulnerability in Anthropic's Claude products could let a browser extension that controls Claude Dispatch make Claude Desktop execute code on a user's computer or on another machine signed into the same Claude account, with no browser exploit and minimal user interaction, according to Forever Security researcher Gal Weizman. Anthropic has known about the issue since May and has not closed it, Weizman said. The flaw, dubbed ThisBash, was disclosed to Anthropic and shared with The Register.

How the attack works

Dispatch lets users send and manage tasks from a mobile phone or browser to Claude Desktop, an AI agent that runs commands on a computer. Weizman found that Dispatch's interface and API were reachable from an ordinary logged-in web session at claude.ai, so an extension able to control claude.ai could send commands to Claude Desktop as if they came from the legitimate Dispatch user. He said Claude's access to operating system files allows code that compromises the machine completely. The attack requires an extension with access to claude.ai, which Weizman said is not very difficult to achieve; hijacking a legitimate extension is often easier than tricking someone into installing a malicious one. Users must be logged in to Claude on the web and Claude Desktop with Dispatch enabled, though Cowork and Code remote-control sessions reduce the need to opt into Dispatch. The chain uses a content script, gets the desktop session ID, prompts the agent, auto-clicks approval prompts, and repeats until code execution. In the proof of concept, Claude installed a malicious npm package; real attacks could steal data or install a backdoor.

Scope and cross-machine risk

The blast radius depends on which desktop the compromised browser session can control through Dispatch. On the same machine, it is a sandbox escape, with the extension using Dispatch to direct the desktop agent. Because Dispatch is designed to work across machines, a compromised session can also reach a connected desktop on another computer, turning the browser into a remote entry point. Weizman said it is even more alarming if an employee shares an account across personal and corporate computers, because Dispatch can become a bridge from a personal Claude account in a browser to Claude Desktop on a work laptop, giving attackers a way to infiltrate an organization for the first time. In six organizations where Forever Security saw shared home and corporate laptop accounts, personal Claude accounts seen in corporate environments ranged from 18 percent to 71 percent.

Anthropic response and design questions

Anthropic acknowledged the report as a valid vulnerability in May, but closed it as a duplicate of a known flaw it was already tracking. It did not pay a bug bounty or issue a CVE, but told Weizman it planned to retire Dispatch at the end of October. That did not happen. As of October 30, the official Claude support page listed Dispatch as available in limited beta on some Pro, Max, and Ultra plans, but not available to new users, and said existing users can keep using it for now. Weizman said the fundamental flaw in Claude's design still exists even if Dispatch is killed off, and the weakness now lives on in features such as Claude Code Remote Control and Claude Cowork sessions. He said Claude Cowork is accessible via the web version and shares the same sessions as the desktop version, so an extension could use Cowork sessions to access files, install a malicious npm package, or run code on the operating system. Weizman suggested treating the web version as a lower-trust device and blocking risky actions requested through it. He said other AI agents, such as OpenAI's Codex, avoid the issue by not sharing sessions.

Sources: The Register