A browser extension with access to claude.ai could get Claude Desktop to execute code on the linked computer, even if that computer was different from the one running the browser. Forever Security demonstrated the attack using Claude Dispatch: the test ended with the installation of an npm package whose installation script opened Calculator. The firm warns that the same mechanism could be used for more harmful actions.
The vulnerability, dubbed ThisBash by its discoverers, did not require exploiting the browser. The extension took advantage of a normal session signed in to claude.ai to control Dispatch and send instructions to the desktop agent as if the user had written them. The risk extended beyond a personal computer if the Claude account was also connected to a work computer.
Anthropic received the report in May 2026 and deemed it valid, according to Forever Security, but later closed it as a duplicate of an issue it was already tracking internally. The company had said it planned to retire Dispatch by the end of October. However, the Claude help page consulted in early November still says the feature is in limited beta and that people already using it can continue to do so.
A web session controlled Dispatch without showing access
Dispatch lets users send tasks from their phone to Claude Desktop, where the agent can work with local files, connectors, plugins, and applications on the computer. For it to work, the computer must be on and the desktop application open. Claude's documentation distinguishes it from a cloud session, which runs on Anthropic's servers.
Forever Security found that Dispatch's interface and API also accepted requests from a regular authenticated claude.ai session. The website did not show a link to the feature, but hiding access did not prevent it from being used. According to researcher Gal Weizman, the extension could open the Dispatch page in the browser and send it requests using the user's session.
The attack required the extension to be able to run scripts on claude.ai and the user to be signed in to both the website and Claude Desktop, with Dispatch enabled. The extension could be malicious from the outset, a legitimate tool updated after a compromise, or a legitimate extension with a vulnerability. Dispatch also only works if the computer is awake and the desktop application remains open.
In the test, a script opened Dispatch and sent Claude four instructions. First, it asked to install an npm package. Claude expressed reservations about the unknown package; a subsequent instruction, worded as if it came from the user, reassured it and prompted it to continue. The extension automatically clicked the «Allow» button every second when an approval request appeared.
Claude eventually ran a global npm installation. The package's script opened Calculator, a visible sign that local code execution had been achieved. Forever Security says that, with Claude's permissions on the computer, the same step could have been used to steal files or install a backdoor. The demonstration did not carry out those actions.
“Anthropic is retiring Dispatch, but not the design behind it.”
— Forever Security
From the browser to a work computer
The demonstration was run with the browser and Claude Desktop on the same computer. Forever Security says Dispatch could also reach a different computer connected to the same Claude account, although it did not show that scenario in the test. An extension installed on a personal computer could therefore send instructions to the agent open on another device.
This bridge is especially concerning when the same personal account is used both at home and on a corporate laptop. If Dispatch is enabled and the work computer is connected, an extension controlling the home browser could end up directing Claude Desktop on the company's computer. Forever Security says it has observed personal accounts with Dispatch cross-device enabled on clients' work computers.
The Register published additional figures from six Forever Security client organizations. Weizman described that sample as a small portion of the firm's client base. In those organizations, personal accounts made up between 18% and 71% of known Claude accounts; in the other four organizations, the percentages ranged from 30% to 44%.
In one of those organizations, 255 of 1,233 known accounts—18%—were personal. Another had 214 personal accounts out of a total of 695, or 31%. The highest percentage was in an organization with 28 known accounts: 20 were personal, or 71%. These figures were shared by Weizman with The Register; they are not a general count of businesses.
Weizman described the potential jump between computers to The Register as a way to reach an organization from a personal account. The scope depends on which computer the compromised session can control and how the devices are connected. The research does not claim that real attacks have occurred: The Hacker News reported that the researchers had not observed incidents of this kind.
The report to Anthropic and the retirement that never happened
Weizman reported the flaw to Anthropic on May 14, 2026. The company accepted it as valid on May 19, but closed the report, considering it a duplicate of an issue it had already identified internally, according to the researchers. The Register adds that there was no reward for the report and no CVE identifier was assigned.
Anthropic said Dispatch would be retired, with the end of October as the target date. The Register reported on November 5 that the retirement had not happened: on October 30, the official page still described the feature as a limited beta for some Pro, Max, and Ultra plans, unavailable to new users. The Claude help page maintains the same availability for people already using it: they can continue to do so «for now».
Anthropic did not respond to The Register's questions, including when it planned to retire the feature. The situation leaves two distinct facts about the product's status: the commitment to retire it by the end of October and the documented availability for existing users in early November. The help page consulted does not announce a shutdown date.
For the researchers, removing Dispatch would not necessarily resolve the design issue. Forever Security and Weizman point to Claude Code Remote Control and Claude Cowork sessions as other features that can allow web extensions to direct local agents. Forever Security announced a subsequent publication about those capabilities, but its analysis does not include tests of their exploitation.
What the research recommends and what Dispatch allows
Forever Security proposes treating access to a web page and authorization to run commands on a computer separately. Weizman suggested that Anthropic give the web version lower permissions than a mobile or desktop device and block actions beyond that level from the web. He also compared the design with OpenAI's Codex: according to him, sessions started or opened on desktop are not shared with the web version, which would prevent interacting with them from the browser.
Claude's help center advises users to trust only the applications and services in the chain, know which files and accounts are accessible, and know how to disconnect or revoke access. The Hacker News also relays the researchers' recommendations: disable Dispatch across devices if it is not needed; review how devices are paired, approved, and removed; control extension permissions and updates; and monitor package installations, configuration changes, credential access, and unexpected external connections.
Official documentation says Dispatch requires recent versions of Claude Desktop and Claude for mobile, a Pro, Max, or Ultra plan, an internet connection on both devices, and an active computer. It is available on macOS, Windows x64, and Linux, although the desktop app control feature is not available in the Linux beta. On that system, tasks involving files, connectors, and plugins can still be performed.
Claude usage also offers a sense of the potential scale, although the cited figures do not represent unique users. The Register attributes about 950 million monthly visits to claude.ai in mid-2026 to Anthropic data. Forever Security cites a Similarweb estimate of between 950 and 969 million visits in September 2026, including repeat visits. Anthropic, meanwhile, analyzed 1.2 million sampled Cowork sessions in May, from more than 600,000 organizations.
Dispatch remains closed to new users, but the official documentation allows current users to continue using it. For now, those who have it enabled should check which devices are linked and whether a browser extension has access to claude.ai.
Sources: The Hacker News, Forever, The Register, Claude Help Center
