# Claude Dispatch "ThisBash": any browser extension on claude.ai can make Claude Desktop run code, and Anthropic won't fix it · pwn.watch > Forever Security researcher Gal Weizman found that Claude Dispatch, the feature that sends tasks from phone or browser to the Claude Desktop agent, is reachable from an ordinary logged-in claude.ai web session. A browser extension that can run scripts on claude.ai can look up the user's Claude Desktop Dispatch session with the user's own cookies, push prompts into it until the agent complies, and auto-click Allow on approval prompts, getting the desktop agent to run commands such as installing a malicious npm package. Because Dispatch works across machines, a compromised browser on one computer can reach Claude Desktop on another computer signed into the same Claude account, for example a work laptop logged into a personal account. Anthropic accepted the report in May, closed it as a duplicate of a known issue, issued no CVE and said it planned to retire Dispatch at the end of October; as of Oct 30 its support page still listed Dispatch in limited beta for existing users. Weizman says the same design weakness also exists in Claude Code Remote Control and Claude Cowork sessions on the web. The attack needs a malicious or hijacked extension with access to claude.ai and the user signed in to both claude.ai and Claude Desktop. Page: https://pwn.watch/i/claude-dispatch-thisbash-extension-to-desktop-rce-nov-2026 · generated 2026-11-05T14:39:04.572Z ## Status - Severity: high · status: live · patch: unpatched - Product: Anthropic Claude Dispatch (claude.ai web with Claude Desktop); per the researcher also Claude Code Remote Control and Claude Cowork web sessions - Started: 2026-11-05 - Affected: Claude Dispatch as offered in limited beta to existing users (as of Oct 30 2026) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/claude-dispatch-thisbash-extension-to-desktop-rce-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/claude-dispatch-thisbash-extension-to-desktop-rce-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/claude-dispatch-thisbash-extension-to-desktop-rce-nov-2026.json - This file: https://pwn.watch/i/claude-dispatch-thisbash-extension-to-desktop-rce-nov-2026/llms.txt ## Updates (newest first) - 2026-11-05: The Register publishes the research (dubbed ThisBash) with the six-step attack chain; Anthropic did not respond to its questions. (https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684) - 2026-10-30: Claude's support page still lists Dispatch as available in limited beta on some Pro, Max and Ultra plans for existing users, though not for new users. (https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684) - 2026-05: Weizman reports the Dispatch flaw to Anthropic, which acknowledges it as valid but closes it as a duplicate of a known issue, pays no bounty, issues no CVE and says it plans to retire Dispatch at the end of October. (https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684) ## Fix brief # Security brief: Claude Dispatch "ThisBash": any browser extension on claude.ai can make Claude Desktop run code, and Anthropic won't fix it Source: https://pwn.watch/i/claude-dispatch-thisbash-extension-to-desktop-rce-nov-2026 · status: live · severity: high · updated Nov 5, 2026, 13:17 UTC ## Patch status **UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.** ## What it is Forever Security researcher Gal Weizman found that Claude Dispatch, the feature that sends tasks from phone or browser to the Claude Desktop agent, is reachable from an ordinary logged-in claude.ai web session. A browser extension that can run scripts on claude.ai can look up the user's Claude Desktop Dispatch session with the user's own cookies, push prompts into it until the agent complies, and auto-click Allow on approval prompts, getting the desktop agent to run commands such as installing a malicious npm package. Because Dispatch works across machines, a compromised browser on one computer can reach Claude Desktop on another computer signed into the same Claude account, for example a work laptop logged into a personal account. Anthropic accepted the report in May, closed it as a duplicate of a known issue, issued no CVE and said it planned to retire Dispatch at the end of October; as of Oct 30 its support page still listed Dispatch in limited beta for existing users. Weizman says the same design weakness also exists in Claude Code Remote Control and Claude Cowork sessions on the web. The attack needs a malicious or hijacked extension with access to claude.ai and the user signed in to both claude.ai and Claude Desktop. Severity detail: Code execution on the desktop, possibly on another machine on the same account, but it needs a malicious or hijacked browser extension with access to claude.ai. No CVE or score was issued. - Product: Anthropic Claude Dispatch (claude.ai web with Claude Desktop); per the researcher also Claude Code Remote Control and Claude Cowork web sessions ## Affected versions - Claude Dispatch as offered in limited beta to existing users (as of Oct 30 2026) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes Claude Dispatch users: the attack needs a browser extension with access to claude.ai, so review and remove extensions that can read claude.ai, avoid signing the same Claude account into both personal and work machines, and stop using Dispatch if you don't need it. Anthropic has published no fix. ## Latest updates - Nov 5, 2026: The Register publishes the research (dubbed ThisBash) with the six-step attack chain; Anthropic did not respond to its questions. - Oct 30, 2026: Claude's support page still lists Dispatch as available in limited beta on some Pro, Max and Ultra plans for existing users, though not for new users. - May 2026: Weizman reports the Dispatch flaw to Anthropic, which acknowledges it as valid but closes it as a duplicate of a known issue, pays no bounty, issues no CVE and says it plans to retire Dispatch at the end of October. ## Write-ups & news - [Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries](https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684) --- Machine-readable: https://pwn.watch/i/claude-dispatch-thisbash-extension-to-desktop-rce-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.