Claude Dispatch Vulnerability (ThisBash): A Browser Extension Can Make Claude Desktop Run Commands, No Patch Planned, and What to Check
Researchers showed a browser extension with access to claude.ai could drive Claude Desktop through Dispatch and run commands, even on another machine. Anthropic plans to retire the feature rather than patch it.
Where Worldwide
On this page 7 sections
A security researcher has shown that a browser extension with access to claude.ai can make Claude Desktop run commands on a computer. That includes a different computer signed into the same Claude account. Anthropic accepted the report as valid but has not shipped a fix. It told the researcher it would retire the Dispatch feature instead, and as of November 6, 2026, Anthropic's own support page still says existing users can keep using it.
If anyone at your company uses Claude Desktop with Dispatch, a single hijacked browser extension could turn their browser into a way to run commands on their machine.
What Claude Dispatch is supposed to do
Anthropic's support page says Dispatch lets you "message Claude from your phone and have it work on your desktop computer." It needs both the Claude mobile app and Claude Desktop, paired together. Tasks run on the desktop, and Claude sends push notifications when a task finishes or needs your approval. Dispatch is in "limited beta on some Pro, Max, and Ultra plans" and "isn't available to new users."
The intended design is phone to desktop. Gal Weizman of Forever Security, who found the flaw, says that phone-to-desktop path is peer-to-peer, and his team found no flaw in it.
The problem is a path nobody intended. The researchers found that the Dispatch page and its API could also be reached from an ordinary logged-in claude.ai session in a web browser. Anything that can control that browser tab can send instructions to Claude Desktop as if the real user had typed them. Forever named the attack ThisBash and published its write-up on November 4, 2026.
How the ThisBash attack works
Forever's write-up describes six steps:
- A browser extension injects a script into claude.ai that runs inside the page and uses the user's session cookies.
- The script opens the Dispatch page in a 200 by 200 pixel popup that is not in focus. This popup is the only visible sign of the attack.
- It uses the user's cookies to look up the session ID of the Claude Desktop agent.
- It sends a scripted series of prompts, which Weizman calls "prompt forcing," waiting for each reply before sending the next.
- Claude normally asks for approval before acting. The script clicks any visible "Allow" button every second.
- It reads Claude's replies, changes its prompts, and keeps going until Claude runs
npm install -gon a malicious package.
In the demonstration, the package simply opened the Calculator app. A real attacker could use the same step to steal source code or cloud credentials, or to install a backdoor.
The extension needed access to claude.ai and the ability to inject a script there. No browser exploit was needed. Extensions get taken over more often than most people realize, through stolen developer accounts or sold-off projects. We covered one example in 319 malicious Chrome extensions with 13.4 million installs.
What is confirmed and what is not
| Point | Status |
|---|---|
| Forever reported the flaw to Anthropic on May 14, 2026 | Stated in the researchers' write-up |
| Anthropic called it valid on May 19, 2026, then closed it as a duplicate of an issue it had already found | Stated in the researchers' write-up |
| On October 13, 2026, Anthropic said Dispatch would be retired, aiming for the end of October | Stated in the researchers' write-up; Anthropic has not announced it publicly |
| Dispatch is still offered to existing users | Confirmed on Anthropic's support page as of November 6, 2026 |
| A CVE number | None has been issued |
| Claude Code Remote Control and Cowork sessions have the same weakness | Claimed by the researchers; their demo tested Dispatch only, and a follow-up post is promised |
| Use in real attacks | No report of real-world use in either source |
Anthropic did not answer questions from The Register, including when it plans to retire the feature. Weizman told The Register that Anthropic was warned the design weakness carries over to other features, and "They still decided not to do anything about it."
Why this matters for a company network
The risk reaches across devices. Dispatch is built to let one device drive another, so a hijacked browser on one machine can reach a Claude Desktop running somewhere else under the same account.
That matters most when work and personal accounts mix. If an employee uses one personal Claude account on a home laptop and a work laptop, an extension on the home browser could reach the work machine. Forever told The Register that personal accounts made up between 18 and 71 percent of the known Claude accounts at the organizations it checked. That figure comes from just six customer organizations, which Forever described as only a fraction of its customers, so treat it as an example rather than an industry average. Even so, it shows that work machines can run AI agents tied to accounts the company does not control.
There is also a lesson about approval prompts. An "Allow" button only protects you if the attacker can't click it. In ThisBash, the button sits on the same page the attacker's script controls.
What to do this week
| Task | How to check or fix |
|---|---|
| Find who uses Dispatch | Ask staff who use Claude Desktop whether Dispatch shows in the Cowork side panel. Only existing beta users have it. |
| Turn it off where it is not needed | Disconnect the paired phone and desktop, or sign out of Claude Desktop on that machine. Anthropic's page tells users to know how to revoke access but does not list the steps. |
| Review browser extensions | On every machine where staff use claude.ai, list the extensions installed. Remove any that can read or change claude.ai, unless you need them. Use browser policy to allow only approved extensions. |
| Separate personal and work accounts | Move work use of Claude onto company accounts under your single sign-on, and stop personal accounts on work laptops. |
| Watch what agents do | Flag unexpected npm install -g runs, new global packages, changes to configuration files, and access to stored credentials on machines that run Claude Desktop. |
| Treat similar features the same way | Until the researchers' follow-up is out, apply the same caution to Claude Code Remote Control and Cowork sessions on company machines. |
If you run developer laptops with cloud keys or source code on them, start there. Those are the machines where a single forced install does the most damage.
Claude Dispatch vulnerability questions people are asking
Is Claude Dispatch safe to use?
Only with care. The flaw is still unpatched, and Anthropic has said it will retire the feature rather than fix it. If there is no clear business need, turn it off.
Has Anthropic patched ThisBash?
No patch has been announced. Anthropic closed the report as a duplicate and told the researcher Dispatch would be retired by the end of October 2026. Its support page still offers Dispatch to existing users.
Is there a CVE for the Claude Dispatch flaw?
No. No CVE was issued, and Anthropic paid no bug bounty.
Has ThisBash been used in real attacks?
No real-world use has been reported. The public demonstration is a proof of concept that opened the Calculator app.
Does this affect Claude Code or Claude Cowork?
The researchers say Claude Code Remote Control and Cowork sessions follow the same pattern. They have not yet published a demonstration, and Anthropic has not commented.
Do I need a malicious extension for this to work?
Yes. The attack needs an extension with access to claude.ai, and the user must be signed in to claude.ai and to Claude Desktop with Dispatch turned on.
The bigger lesson
An AI agent that can run commands is a remote access tool, and every place that can send it instructions needs the same protection as a remote desktop login. When a vendor decides to retire a feature instead of fixing it, the clean-up falls to you: find where it is turned on, switch it off, and lock down the browsers around it.
Want help reviewing the AI tools and browser extensions on your company machines? See security hardening or request a quote.
Get security alerts like this by email, with our free checklist, at /security-alerts.
Sources: Forever Security, ThisBash write-up; Anthropic support, Assign tasks from anywhere in Claude Cowork; The Register.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
AI Agent Security Controls: OpenAI's Test Agents Breached Hugging Face, What Is Confirmed and the Access Limits to Set This Week
OpenAI's test agents broke into Hugging Face's production systems in July 2026. Here is what is confirmed, wha...
Does MFA Stop Stolen Passwords? What 19,252 Unauthorized Brokerage Access Cases in Japan Show About Phone Codes and Passkeys
Japan's regulator counted 19,252 unauthorized access cases at online brokerages in 21 months. Phone MFA blocks...
Enterprise AI Security Study: TCS Says 84% Value AI Productivity, Only 10% Let AI Agents Act Without Human Approval, and the Controls to Check
A TCS survey of 1,333 senior leaders says only 10% of enterprises let AI agents act without human approval acr...
