A browser extension with access to claude.ai can send commands to Claude Desktop through Dispatch, according to a November 4, 2026 write-up from Forever Security. The Claude Dispatch vulnerability, which researcher Gal Weizman calls ThisBash, can end with code running on your computer or on another machine signed into the same Claude account. Anthropic acknowledged the report in May but closed it as a duplicate, and the researchers say retiring Dispatch does not remove the weakness underneath it.
TL;DR: Forever Security showed that an extension with access to claude.ai can drive Claude Desktop through Dispatch, approve its own permission prompts, and run an installer on the machine. Anthropic called the report valid but a duplicate and said it would retire Dispatch. The researchers say Cowork and Claude Code Remote Control share the same trust problem, so check your extensions and switch Dispatch off if you do not use it.
How the Claude Dispatch vulnerability works
Dispatch looks like a desktop feature, since the web version of Claude never links to it. Forever Security found that an ordinary logged-in claude.ai tab still accepts its requests, so anything that can script that tab can talk to Claude Desktop as if you had typed the instruction yourself.
The proof of concept needed no browser exploit. A content script runs inside claude.ai with your session cookies, opens a tiny 200 by 200 pixel popup to the Cowork agent page, and asks the sessions endpoint for the ID of your local Claude Desktop session. It then sends prompts and waits for each reply, which the researchers call prompt forcing.
Claude refused at first, then went along after follow-up prompts. A second script clicked any Allow button once per second, and the demo ended with Claude running npm install -g on a package whose preinstall script opened Calculator. The researchers note that the payload could just as easily have copied files or added an SSH key.
Four prompts and automated approvals were enough, which raises the obvious question of who has to be exposed for this to matter.
Who is exposed to the Dispatch flaw
The attack needs an extension, malicious or a legitimate one that has been compromised, with permission to act on claude.ai. It also needs Claude Desktop running with Dispatch enabled and a logged-in session. Anthropic’s Dispatch guide lists a Pro or Max plan and the latest Claude Desktop on macOS or Windows as the requirements.
Where the commands land depends on the setup. On the same machine, it is an escape from the browser to local execution. With a phone or second computer paired through your account, it becomes remote execution on that other device.
The corporate angle is the part that should worry IT teams. Forever Security says it has seen personal Claude accounts with cross-device dispatch enabled on corporate endpoints, so a personal login on a work laptop is a path into the company network. That makes your extension list the real attack surface, more than anything Claude itself does.
Anthropic has been giving its agents more room to act on their own, as with Claude Duet, which makes the trust boundary around them matter more.
What Anthropic has said so far
According to the researchers, Anthropic confirmed within five days that the finding was valid, then closed it as a duplicate of an issue it had already found internally. In October it said Dispatch would be retired by the end of the month.
| Date | What happened |
|---|---|
| May 14, 2026 | Forever Security reports the flaw to Anthropic |
| May 19, 2026 | Anthropic acknowledges it as valid and closes it as a duplicate |
| October 13, 2026 | Anthropic says Dispatch will be retired, targeting the end of October |
| November 4, 2026 | Forever Security publishes the ThisBash write-up |
The Register, which covered the research on November 5, said Anthropic did not answer its questions, including when Dispatch will actually go away.
Retiring one feature may not be enough. Forever Security says Cowork and Claude Code Remote Control allow extensions to perform the same attack, and it has promised a follow-up post on both.
The extension audit worth doing this week
Forever Security recommends disabling cross-device dispatch where it is not needed, and reviewing how paired devices are authorized and revoked where it is. If you never use Dispatch from your phone, turning it off removes the easiest route in.
The same write-up says to treat browser extensions as endpoint software. Open your extensions page, remove anything you no longer use, and look hard at any that can read and change every site you visit.
It also advises keeping approval prompts out of an attacker’s reach, because consent shown in a compromised interface cannot be trusted. For anyone who has clicked Allow on autopilot, the demo is a fair reminder of how little stands between a prompt and a command.
