Claude Dispatch flaw exposes a path from browser extensions to desktop commands

Gal Weizman, a security researcher at endpoint-protection vendor Forever Security, discovered the weakness. His firm's earlier MaXSS and Spyder research examined how flaws in legitimate browser extensions could let attacker-controlled websites act across other sites. That work is relevant here because ThisBash requires control over claude.ai, whether through a malicious extension or a compromised legitimate one. Forever Security also sells protection for traditional and agentic software, giving it a commercial stake in the broader security recommendations.

The firm's technical disclosure says Claude Desktop is built with Electron, which lets developers build desktop applications using web technologies, and shares much of its web interface and API with claude.ai. Dispatch had no visible link on the website, but its page and API still accepted requests from an ordinary authenticated web session. Hiding the link did not create an authorization boundary.

The attacker controls both requests and approvals

The demonstrated attack required an extension with permission to act on claude.ai, a logged-in web session and a reachable Claude Desktop session with Dispatch enabled. It used the product's own integration rather than a browser exploit.

In the proof of concept, the extension opened a small, unfocused Dispatch window, located the desktop session and submitted four prompts. Claude initially hesitated to install an unfamiliar software package. Follow-up messages impersonating the user reassured it, and the installation proceeded, according to the researchers.

The demonstration also automated clicks on approval buttons in the web interface. That matters as much as the prompts: a confirmation cannot establish independent user consent when the component sending the request can also click the confirmation.

The agent invoked Claude Code to install an npm package whose pre-installation hook launched Calculator, demonstrating code execution. Credential theft, stolen source code and backdoor installation are potential consequences described by the researchers, rather than observed outcomes of this test. The available evidence does not establish a real-world corporate intrusion using ThisBash.

The researchers call the conversational technique “prompt forcing”: an attacker controls the apparent user's input channel, reads the agent's replies and supplies follow-up instructions. It differs from hiding a malicious instruction inside a document the assistant happens to read. In this demonstration, the attacker could also act on the approval interface.

Forever Security’s company-reported scenarios show how Dispatch could reach another computer. Corporate exposure requires a linked account and an available work desktop with Dispatch enabled; no corporate intrusion was demonstrated. Source: Forever Security.

The account can connect different security environments

On one computer, the demonstrated path takes an extension beyond browser access into commands executed with the desktop agent's permissions. If the reachable desktop is on another computer, the same integration can carry instructions to that machine. The corporate scenario requires a further condition: an account connecting an attacker-controlled browser environment to an available work desktop with Dispatch enabled.

Forever Security says it has observed personal Claude accounts with cross-device dispatch enabled on corporate endpoints in customer environments. That makes a company's exposure partly dependent on account use outside its managed devices, rather than solely on which extensions it permits on work laptops.

A report on the research includes personal-account counts supplied by Forever Security from six customer organizations, explicitly a small subset of the firm's customers. Two examples were 214 personal accounts among 695 known Claude accounts, and 20 among 28. These observations support investigating mixed personal and work use; they do not measure how many accounts had vulnerable Dispatch sessions, or establish a representative enterprise exposure rate.

Extension compromise also has a history independent of AI agents. A December 30, 2024 government security advisory described a phishing campaign targeting extension developers that injected malicious code into legitimate Chrome extensions. The UAE Cyber Security Council, citing security researchers, described at least 16 compromised extensions and more than 600,000 users potentially exposed to data theft and credential harvesting. That precedent establishes a route to extension control, not evidence that those extensions exploited Claude.

Broader Cowork adoption figures should not be read as a vulnerability count either. In its usage analysis, Anthropic said it sampled 1.2 million anonymized and aggregated Cowork sessions from more than 600,000 organizations during May 11–31, 2026. Sampling used a fixed hourly cap rather than a fixed traffic share; the company warns that the counts do not measure total usage or growth and that the sample includes some personal use. It provides no count of Dispatch users or vulnerable sessions.

Magica timeline of Forever Security’s company-reported disclosure milestones. The October communication described planned retirement, not completed retirement. Source: Forever Security.

What retirement still needs to resolve

Forever Security says it reported the flaw on May 14, 2026. Its disclosure says Anthropic acknowledged the findings as valid on May 19 but closed the submission as a duplicate of an issue already found internally. On October 13, Anthropic told the researchers it planned to retire Dispatch, targeting the end of October.

The November 5 report said the flaw remained unclosed and Anthropic did not respond to questions about its plans. It also said Weizman received neither a bug bounty nor a CVE identifier. Those are reported disclosure outcomes; Anthropic's public support page confirms continued availability to existing users, rather than explaining the vulnerability's status.

Weizman proposes treating the web client as a distinct, lower-trust device, with restrictions on the commands it can authorize. The issue is not that every connection between phone and desktop is unsafe: the researchers say they found no flaw in the mobile-to-desktop interaction they examined. Their objection concerns the authority available through the browser session. In the report, Weizman contrasts this with OpenAI's Codex coding agent, saying its web client cannot access sessions started on the desktop. That is the researcher's comparison of session access, not a demonstrated security assessment of the competing product.

Anthropic's own Dispatch documentation warns that chaining agents and services can turn manipulated instructions or unexpected commands into consequential actions. It advises users to understand accessible files and accounts and know how to disconnect or revoke access. Those warnings acknowledge the general risk of delegated action; they do not establish that ThisBash has been repaired.

The researcher also argues that related trust-boundary problems extend to Claude Code Remote Control and shared Cowork sessions. The detailed published demonstration concerns Dispatch; the disclosure does not show equivalent end-to-end exploits for each of those features.

For organizations using Dispatch, Forever Security recommends identifying the accounts and connected devices involved, disabling unnecessary cross-device control, and reviewing how access is paired and revoked. It also recommends approval controls that cannot be operated by the same component initiating a sensitive request.

The next decision for Anthropic is whether and when to disable Dispatch for existing users, or enforce an authorization boundary between browser access and desktop commands. Retirement could remove the demonstrated entry point. Establishing the safety of other connected features requires evidence about their own permission and device controls.