VULNpocalypse
HighVulnerabilityMonitoring

Anthropic won’t fix a Claude Dispatch flaw that lets browser extensions run commands on connected computers

A browser extension on claude.ai can drive Claude Dispatch to run commands on connected desktops. Anthropic closed it as a duplicate and won’t fix it.

Published
Updated
Fixed in
No fix planned. Anthropic acknowledged the report as valid but closed it as a duplicate of an issue it was already tracking, issued no patch and no CVE, and told the researcher it planned to retire Dispatch around the end of October 2026
Exploitation
No in-the-wild exploitation reported. Demonstrated only in a Forever Security proof of concept that opened the Calculator app via a malicious npm install hook

What happened

  • Claude Dispatch is a feature that lets a user send tasks from a phone or browser to Claude Desktop, an AI agent that can work with local files, apps and commands on the user’s computer (The Register; Cyber Security News).
  • Gal Weizman of Forever Security found that a malicious browser extension could abuse Dispatch to run commands on a connected computer, naming the technique “ThisBash” (The Register; GBHackers). It was reported to Anthropic on 14 May 2026 (Cyber Security News; GBHackers).
  • No CVE has been issued (The Register; Cyber Security News).

The flaw. Claude Desktop is an Electron app built largely on the same web interface and API as claude.ai; the web version hid the Dispatch link but did not block access to it (Cyber Security News; GBHackers). As GBHackers summarises it, “The missing link hid the feature without restricting access” (GBHackers). The Register describes the root issue as a design choice: Dispatch’s interface and API were reachable from an ordinary logged-in claude.ai session, so any browser extension able to control claude.ai could send commands to Claude Desktop as if they came from the legitimate user (The Register).

How the proof of concept worked. A Manifest V3 browser extension with a content script on claude.ai opened the Dispatch page in a small (200x200) unfocused popup, then used the user’s cookies to query a sessions endpoint and locate the local desktop agent (Cyber Security News; GBHackers). It then sent scripted prompts into the chat while a one-second timer auto-clicked every “Allow” approval button, so no human was needed (Cyber Security News; GBHackers). The researchers call this “prompt forcing”: the attacker controls the input channel, reads the model’s responses and keeps rephrasing until it complies, which differs from one-shot prompt injection (GBHackers). Four prompts were enough to make Claude install an unknown npm package whose install hook opened the Calculator app as a demonstration (Cyber Security News; GBHackers). The researchers say a real payload could exfiltrate files, add SSH keys or install a backdoor (The Register; GBHackers).

Why it crosses corporate boundaries. Dispatch is designed to link devices, so the browser and desktop need not be on the same machine; an extension on a personal laptop could target a work laptop signed into the same Claude account, where source code and cloud keys may sit (The Register; Cyber Security News). Forever Security says it has seen personal Claude accounts with cross-device dispatch enabled on corporate endpoints, and that across a sample of six organisations 18% to 71% of Claude accounts were personal (The Register). GBHackers cites a LayerX figure that 99% of enterprise users had at least one browser extension and 53% had extensions with high or critical permissions (GBHackers). The researchers add that Claude Code remote control and Claude Cowork sessions share the same design and may be exploitable the same way (The Register; Cyber Security News).

Anthropic’s response. Anthropic acknowledged the report as valid but closed it as a duplicate of an issue it was already tracking, paid no bug bounty and issued no CVE (The Register); Cyber Security News dates the acknowledgement to 19 May 2026 (Cyber Security News). Anthropic told the researcher it planned to retire Dispatch around the end of October 2026, a date The Register reports had not clearly been met at publication (The Register; GBHackers). Weizman’s view, per The Register, is that Anthropic “still decided not to do anything about it” (The Register). Anthropic’s own support page lists Dispatch as “in limited beta on some Pro, Max, and Ultra plans” that “isn’t available to new users,” and tells current users: “If you already use Dispatch, you can keep using it for now” (Anthropic support).

What to do

With no patch available, the sources’ mitigations are organisational (Cyber Security News; GBHackers):

  1. Inventory AI agents on endpoints and the Claude accounts they use, and check whether those accounts sit under company single sign-on.
  2. Disable cross-device dispatch / remote control where there is no business need, and review how devices are paired and removed.
  3. Keep personal and work Claude accounts separate, personal accounts off work devices, work accounts out of personal browsers.
  4. Govern browser extensions like endpoints: limit who can install them, review their permissions, and watch for updates that request more access.
  5. Make approval prompts something the requesting component cannot click itself, so an automated loop cannot grant its own approvals.
  6. Monitor agent processes for unexpected package installs, configuration changes, credential access and outbound connections, and consider Anthropic’s beta EDR monitoring option for Claude Cowork on Team and Enterprise plans.

Sources