A design flaw in Anthropic’s Claude Dispatch feature let a malicious browser extension run commands on the operating system, even on a different computer. Researchers at Forever Security named the attack ThisBash.
They found that Claude Dispatch accepted instructions from an ordinary logged-in claude.ai session. An extension that could control that site could therefore send commands to Claude Desktop as if the user had typed them.
Claude AI Flaw
Dispatch lets users message Claude from a phone and have it work on their desktop, using local files, connectors, plugins and apps, according to Anthropic’s documentation.
Claude Desktop is an Electron app built largely on the same web interface and API as claude.ai. The web version hid the Dispatch link. Once someone extracted the URL from the desktop app, any authenticated browser tab could open it and send requests. The missing link hid the feature without restricting access.
The proof of concept needed no browser exploit. A Manifest V3 extension registered a content script on claude.ai and opened the Dispatch page in a 200×200 unfocused popup.
It then called the sessions endpoint with the user’s cookies to find the local desktop session. The script sent four scripted prompts, waiting for Claude’s reply after each. A one-second timer clicked every “Allow” button that appeared, so no one had to approve anything.
Claude initially hesitated to install an unfamiliar npm package. The follow-up prompt reassured the user, and the installation proceeded. The package’s preinstall hook opened Calculator.
The researchers call this technique prompt forcing: the attacker controls the input channel, reads Claude’s responses, and adapts. This differs from one-shot prompt injection. A real payload could exfiltrate files, add SSH keys, or install a backdoor.
Reach is the larger concern. The browser and the desktop can sit on different machines, so an extension on a personal laptop could target a work laptop signed into the same Claude account.
Forever Security says it has seen personal Claude accounts with cross-device dispatch enabled on corporate endpoints. LayerX’s 2025 report found that 99% of enterprise users had at least one extension installed, and 53% had extensions with high or critical permissions.
Forever Security reported the issue to Anthropic on May 14, 2026, and Anthropic acknowledged it as valid. Anthropic says Dispatch will be retired, targeting the end of October 2026, and the flaw remains exploitable until then. Its help pages now say Dispatch is unavailable to new users, though existing users can keep using it.
The researchers argue the root cause outlives Dispatch. An authenticated web session is not proof that the user authorized a command on their machine. They say Claude Code Remote Control and Claude Cowork sessions allow extensions to perform the same attack, and they plan a follow-up post on the wider implications.
This is the latest in a run of Claude-related agent risks. Earlier this year, researchers disclosed a zero-click RCE in Claude Desktop Extensions that needed only a Google Calendar event to compromise a computer.
Most recently, a trojanized Claude Code extension in Cursor’s marketplace attempted to plant persistent SSH backdoors. See the report on malicious Claude Code extensions for details.
Organizations should start by inventorying which AI agents and Claude accounts are in use, and turn off cross-device dispatch where it isn’t needed. Keep personal and work Claude accounts separate so a compromised home browser cannot reach a managed laptop.
Browser extensions deserve the same governance as endpoint software, with controlled installation and regular permission reviews. Security teams should also monitor agent processes for unexpected package installs, credential access, and outbound connections, and review Anthropic’s guidance on using Cowork safely before enabling remote control of desktop agents.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
