Claude Dispatch flaw lets a browser extension run code on your PC

A browser extension with permission to script claude.ai can drive Claude Desktop into running operating-system commands, according to research published November 4 by Forever Security. Researcher Gal Weizman calls the technique "ThisBash." There is no CVE, no public exploit code, and the demonstrated payload only opened Calculator — but the mechanism is worth an operator's attention, because it turns one more browser extension into a path to code execution on the endpoint.

This is an AI/LLM-security story, a hype-prone beat, so read the claims as Forever Security's account unless stated otherwise. We link the primary writeup and cross-checked it against The Register and The Hacker News.

What Dispatch is

Claude Dispatch is a feature in Claude Desktop's Cowork surface that lets a user send tasks to the desktop agent, including across devices. Claude Desktop can run commands on the machine it's installed on.

What the research shows

Weizman's finding is an authorization gap, not a memory bug. Dispatch's interface and API were reachable from a normal, logged-in claude.ai browser tab — even though the web app exposed no link to it. The researchers found the Dispatch URL inside the Electron desktop app, and the service accepted requests carrying the ordinary web session's cookies.

From there, a browser extension that can register a content script on claude.ai — which shares that page's session — can:

• open the Cowork agent page in a tiny, unfocused popup and query for the local Claude Desktop session ID;
• type prompts into the composer and read Claude's replies from the page DOM;
• run a timer that clicks any "Allow" approval button every second, because the prompt renders inside the page the extension already controls.

In the proof of concept, four scripted prompts asked Claude to list folders, then globally install an npm package in /tmp. Claude hesitated; the follow-up prompts supplied reassurance "in the user's voice," and it proceeded. The package's preinstall hook opened Calculator.

The attack requires a malicious extension (or a legitimate one that's compromised or flawed), a user signed in to both claude.ai and Claude Desktop, and Dispatch enabled. Because Dispatch is built to relay work between devices, the researchers describe a cross-device case — a personal Claude account at home reaching Claude Desktop on a work laptop — and say they have seen personal accounts with cross-device dispatch enabled on corporate endpoints. That last observation is unquantified.

Limits and caveats

• No CVE has been assigned, and the writeup publishes partial snippets (manifest, content-script registration, polling loop, auto-click), not a downloadable exploit.
• The demonstrated impact was opening Calculator. File theft, persistence and encryption are described as possible, not shown.
• Disclosure timeline: reported to Anthropic May 14; acknowledged valid on May 19 but closed as a duplicate of an issue Anthropic says it had already found internally; on October 13 Anthropic told the researchers Dispatch would be retired, targeting end of October. The writeup does not quote Anthropic directly and does not say the underlying authorization gap was patched. Forever Security states the flaw "remains exploitable" until Dispatch is gone; Dispatch is already closed to new users, while some Pro/Max/Ultra users retain it.

What to do

1. Treat agent-running desktop apps (Claude Desktop, and comparable tools) as privileged endpoint software, and inventory which accounts they run under and what those accounts can reach.
2. Disable cross-device dispatch where you don't need it; where you do, review how devices are paired, authorized and revoked.
3. Manage browser extensions like endpoint software — review permissions and flag changes to extensions that can script AI vendor sites.
4. Keep the approval step out of reach of the component that initiates the request; an "Allow" button that lives in attacker-controlled page content is not a control.
5. Monitor agent activity: package installs, config changes, credential access, outbound connections.

Context

The pattern here — a web session that quietly authorizes a local agent, with human approval rendered inside content an attacker can drive — is not unique to one vendor. Forever Security says the same shape appears in Claude Code Remote Control and Cowork sessions and promises a follow-up. The defensive takeaway outlives this specific feature: as desktop AI agents gain the ability to execute, the browser tab becomes part of their attack surface, and extension governance becomes endpoint security.