Anthropic has left unresolved a design flaw in Claude Dispatch that can let a malicious or hijacked browser extension make Claude Desktop execute commands on the user’s computer—or on another machine signed into the same Claude account. Forever Security researcher Gal Weizman disclosed the issue to Anthropic in May; according to The Register’s report, the company accepted it as a valid vulnerability but closed it as a duplicate of an issue it was already tracking. Anthropic assigned no CVE and did not issue a fix.
The attack, which Weizman calls “ThisBash,” abuses the fact that Dispatch’s web interface and API can be reached from an authenticated claude.ai session. An extension with permission to run code on that site can discover a Claude Desktop session, send prompts to the connected agent and repeatedly approve actions. In Weizman’s proof of concept, the agent was persuaded to install a malicious npm package whose installation hook launched the calculator; a real attack could instead steal source code and cloud credentials or install a backdoor.
The vulnerability requires a malicious or compromised extension and an authenticated user, but no browser exploit or sophisticated interaction. The risk is greater because Dispatch was designed to connect devices: a browser running on a personal computer could potentially direct Claude Desktop on a corporate laptop using the same account. Weizman said the underlying session-sharing design also affects Claude Cowork and Claude Code Remote Control, meaning retiring Dispatch alone would not necessarily remove the attack path. Anthropic’s own support documentation says Dispatch runs tasks on a desktop with Claude Desktop open, while its product material describes the feature as a continuous conversation across phone and desktop. Anthropic’s support page listed Dispatch as limited beta for some existing paid users as of early November.
Weizman recommended separating web sessions from desktop-agent sessions and assigning web clients weaker permissions, rather than allowing them to discover and control sessions with operating-system access. Until Anthropic documents a mitigation, organizations should review Claude browser extensions, remove unneeded extensions, avoid sharing Claude accounts across personal and corporate devices, and disable remote-control features where possible. The public reporting describes a working proof of concept but provides no evidence of exploitation in the wild or attribution to a named threat actor.
