#Browser Extension

Claude Dispatch "ThisBash": any browser extension on claude.ai can make Claude Desktop run code, and Anthropic won't fix it

Forever Security researcher Gal Weizman found that Claude Dispatch, the feature that sends tasks from phone or browser to the Claude Desktop agent, is reachable from an ordinary logged-in claude.ai web session. A browser extension that can run scripts on claude.ai can look up the user's Claude Desktop Dispatch session with the user's own cookies, push prompts into it until the agent complies, and auto-click Allow on approval prompts, getting the desktop agent to run commands such as installing a malicious npm package. Because Dispatch works across machines, a compromised browser on one computer can reach Claude Desktop on another computer signed into the same Claude account, for example a work laptop logged into a personal account. Anthropic accepted the report in May, closed it as a duplicate of a known issue, issued no CVE and said it planned to retire Dispatch at the end of October; as of Oct 30 its support page still listed Dispatch in limited beta for existing users. Weizman says the same design weakness also exists in Claude Code Remote Control and Claude Cowork sessions on the web. The attack needs a malicious or hijacked extension with access to claude.ai and the user signed in to both claude.ai and Claude Desktop.

Anthropic Claude Dispatch (claude.ai web with Claude Desktop); per the researcher also Claude Code Remote Control and Claude Cowork web sessions·Since Nov 5, 2026·updated Nov 5, 2026, 13:17 UTC