Claude Dispatch flaw lets browser extensions reach desktop commands

Security researcher Gal Weizman of Forever Security has disclosed ThisBash, a flaw in Claude Dispatch that allowed a browser extension with access to claude.ai to send instructions to Claude Desktop and ultimately execute code on a connected computer. Because Dispatch links devices, the targeted desktop could be a different machine signed into the same Claude account.

The proof of concept used the victim’s authenticated browser session to discover the desktop agent, open Dispatch in a small background window and submit prompts. When Claude hesitated, the script supplied follow-up messages in the user’s voice and automatically clicked approval buttons. The final payload installed an npm package whose setup script opened Calculator, demonstrating operating-system code execution.

This was not a drive-by attack against every Claude user. An attacker first needed a malicious or compromised browser extension able to act on claude.ai, plus a connected desktop session. Forever Security reported no exploitation in the wild. The concern is that an extension normally confined to the browser could cross into a higher-privilege local agent and, in some cases, reach a work computer from a personal browser.

Weizman says he reported the issue in May. Anthropic acknowledged it as valid but closed the report as a duplicate of an existing issue, according to the researcher. The company planned to retire Dispatch, although its support page still allowed existing beta users to continue using it when the report was published. Anthropic did not answer The Register’s questions.

Forever Security argues that the underlying trust boundary may also matter for Claude Code Remote Control and Cowork sessions: an authenticated web session proves who is logged in, but not that the user authorized commands on a local machine.