A browser extension with access to claude.ai can push Claude Desktop into installing software and running code. The target can be the same computer or a different one signed in to the same account. Gal Weizman, a researcher at Forever Security, described the Claude Dispatch flaw in a Forever Security write-up on the ThisBash attack published on November 4, 2026.
Anthropic has known about the issue since May. According to The Register’s report on Anthropic’s handling of the Dispatch bug, the company has not closed the hole. It paid no bug bounty and issued no CVE. Forever Security did not publish a CVSS score, and no fixed version has been named.
What Dispatch is and where the gap sits
Dispatch lets you message Claude from your phone and have it work on your desktop. Anthropic’s help page for Dispatch in Claude Cowork says the agent can use local files, connectors, plugins and apps. The computer must stay awake, and the desktop app must stay open.
Weizman found no flaw in the phone-to-desktop connection. The problem was the browser path. Claude Desktop is an Electron app built largely on the same web interface and API as claude.ai. The Dispatch page had no link in the web version, but it still opened in a normal browser tab.
Worse, Dispatch accepted requests from an ordinary logged-in claude.ai session. Hiding the link did not limit access to the API. Forever Security sums up the root cause plainly: “an authenticated web session is not, by itself, evidence that the user authorized a command on their machine.”
What changes for you
The risk depends on how you use Claude. The demonstrated chain needs several pieces in place at once. Here is how the verified facts map to different users.
| Your situation | Exposure, per the researchers | What to do |
|---|---|---|
| You use Dispatch and have extensions that can act on claude.ai | An extension could send commands to Claude Desktop as you | Review those extensions and their permissions |
| One Claude account on a home browser and a work laptop | A home extension could drive the agent on the work machine | Separate personal and work accounts, or turn off cross-device Dispatch |
| No Claude Desktop with Dispatch running on any device | The demonstrated chain does not work | Watch for news on Remote Control and Cowork sessions |
| New user without Dispatch | Anthropic says Dispatch is not available to new users | Anthropic points these users to Cowork in the cloud |
| Company IT and security teams | Personal accounts on corporate endpoints can bridge outside browsers to work devices | Inventory agents, accounts and extensions |
Put simply, the browser becomes a remote entry point. Claude Desktop runs on macOS, Windows and Linux, so the issue is not tied to one operating system.
How the ThisBash attack works
This section covers the technical steps. General readers can skip ahead to the timeline.
The six steps
- The extension runs a script on claude.ai that shares the page’s session and cookies.
- The script opens Dispatch in a tiny, unfocused popup. Forever Security says this window is the only visible trace.
- It queries the session API to get the ID of the Claude Desktop agent.
- It sends a series of prompts, waiting for each reply before sending the next.
- It clicks the “Allow” approval buttons on a timer. The Register says the script clicked at one-second intervals.
- It reads Claude’s replies and rephrases until the action goes through.
Forever Security calls this “prompt forcing.” It differs from a one-shot prompt injection, because the attacker controls the whole conversation.
How the guardrails gave way
Claude first hesitated to install an unfamiliar npm package. A follow-up prompt, written in the user’s voice, reassured it. After four handwritten prompts and the automatic approvals, Claude installed the package. Its preinstall hook opened the Calculator app.
That proves local code execution without a browser exploit or extra user clicks. Data theft was not demonstrated. The write-up says a real payload could steal files, add SSH keys or install a backdoor. The Register adds source code and cloud credentials as possible targets. These outcomes depend on what Claude can access, and no confirmed real-world attacks have been reported.
What an attacker needs
- A browser extension with permission to act on claude.ai. It could be malicious, hijacked through an update, or a flawed legitimate tool.
- An active claude.ai login in that browser.
- Claude Desktop open, with Dispatch reachable, on the same machine or another one tied to the account.
Weizman told The Register that extension hijacks “happen a lot,” through supply-chain attacks or the purchase of legitimate extensions. He put the potential reach at “millions of installs.”
Why the personal-work link matters
The most serious case crosses company boundaries. A personal Claude account signed in on a work laptop can link a home browser to a corporate device. Forever Security says it has seen cross-device Dispatch enabled on corporate endpoints at customers.
The firm shared data with The Register from six organizations. Personal accounts made up 18% to 71% of the Claude accounts seen in those corporate environments. One company had 255 personal accounts out of 1,233. Another had 214 of 695, and the highest had 20 of 28. Weizman called the six a “small subset” of customers.
Timeline of the disclosure
- May 14, 2026: Forever Security reports the flaw to Anthropic.
- May 19, 2026: Anthropic accepts it as valid but closes it as a duplicate of an issue it found internally.
- October 13, 2026: Anthropic tells the researcher it will retire Dispatch, targeting the end of October.
- October 30, 2026: Anthropic’s support page still lists Dispatch in limited beta, according to The Register.
- November 4-5, 2026: Forever Security publishes its findings, and The Register reports on them.
Anthropic’s help page now says Dispatch is in limited beta on some Pro, Max and Ultra plans. It is closed to new users. Existing users “can keep using it for now,” the page says. It gives no retirement date. Anthropic did not answer The Register’s questions, including when the feature will go away.
Steps to take now
- Open your browser’s extension list and check which add-ons can read or change data on claude.ai.
- Remove extensions you do not need, and review any that ask for new permissions.
- If you do not rely on Dispatch, avoid leaving Claude Desktop paired and open for remote tasks.
- Keep personal and work Claude accounts separate where possible.
- For companies, Forever Security advises disabling cross-device dispatch without a business need and monitoring agents for unexpected package installs, config changes and credential access.
Anthropic’s own help page adds a broader warning. Only connect these agents “if you’re comfortable with what they could do,” it says.
What remains unclear
Retiring Dispatch may not end the problem. Weizman says Claude Code Remote Control and Claude Cowork sessions let extensions run “the very same attack.” Forever Security has not yet published separate tests of those features and promises a follow-up post.
The researcher suggests treating the web version of Dispatch as a separate, lower-trust device that cannot run commands. He contrasted Claude with OpenAI’s Codex, which he says does not share sessions between web and desktop. Anthropic has not said whether it agrees with that diagnosis. It also has not said what its internal duplicate report covered or when it will ship a fix.
