Claude Dispatch "ThisBash": any browser extension on claude.ai can make Claude Desktop run code, and Anthropic won't fix it
Anthropic Claude Dispatch (claude.ai web with Claude Desktop); per the researcher also Claude Code Remote Control and Claude Cowork web sessions
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Forever Security researcher Gal Weizman found that Claude Dispatch, the feature that sends tasks from phone or browser to the Claude Desktop agent, is reachable from an ordinary logged-in claude.ai web session. A browser extension that can run scripts on claude.ai can look up the user's Claude Desktop Dispatch session with the user's own cookies, push prompts into it until the agent complies, and auto-click Allow on approval prompts, getting the desktop agent to run commands such as installing a malicious npm package. Because Dispatch works across machines, a compromised browser on one computer can reach Claude Desktop on another computer signed into the same Claude account, for example a work laptop logged into a personal account. Anthropic accepted the report in May, closed it as a duplicate of a known issue, issued no CVE and said it planned to retire Dispatch at the end of October; as of Oct 30 its support page still listed Dispatch in limited beta for existing users. Weizman says the same design weakness also exists in Claude Code Remote Control and Claude Cowork sessions on the web. The attack needs a malicious or hijacked extension with access to claude.ai and the user signed in to both claude.ai and Claude Desktop.
Why this severity: Code execution on the desktop, possibly on another machine on the same account, but it needs a malicious or hijacked browser extension with access to claude.ai. No CVE or score was issued.
- Started
- Nov 5, 2026
Affected
- Claude Dispatch as offered in limited beta to existing users (as of Oct 30 2026)
Fixed in
No fixed release yet
Timeline3
The Register publishes the research (dubbed ThisBash) with the six-step attack chain; Anthropic did not respond to its questions.
Claude's support page still lists Dispatch as available in limited beta on some Pro, Max and Ultra plans for existing users, though not for new users.
Weizman reports the Dispatch flaw to Anthropic, which acknowledges it as valid but closes it as a duplicate of a known issue, pays no bounty, issues no CVE and says it plans to retire Dispatch at the end of October.
News & write-ups1
Get an email when a new major security incident drops. No spam, unsubscribe any time.
