AI security

Browser extensions can drive Claude Desktop via Dispatch

By Yaali. November 7, 2026, 6 min read, AI security, Vulnerabilities.

ThisBash lets an extension on claude.ai make Claude Desktop run commands through Dispatch. Anthropic has no fix. How it works and what to lock down.

On November 4, Gal Weizman of Forever Security published ThisBash, a flaw in Claude Dispatch. Dispatch lets a user send tasks from a phone to Claude Desktop, Anthropic's agent that runs commands on the computer it is installed on. Weizman found that Dispatch also answers to an ordinary signed-in claude.ai browser tab. Any browser extension that can run scripts on claude.ai can therefore give Claude Desktop instructions as if the user typed them, approve its permission prompts, and get it to run code on the machine.

You are exposed if someone uses Dispatch, which is in limited beta on some Pro, Max and Ultra plans, and has a browser extension with access to claude.ai. Anthropic accepted the report in May but closed it as a duplicate, and has shipped no fix. It told the researchers it would retire Dispatch at the end of October. As of November 7 the Claude help page still says existing users "can keep using it for now", so there is no version to update to. The defence is extension control and turning Dispatch off.

How it works

Dispatch was presented as a phone-to-desktop feature. The claude.ai website shows no Dispatch link, but the Dispatch web interface and its API accept the same session cookies as any logged-in claude.ai tab. Forever reports finding no flaw in the phone-to-desktop connection itself. The weakness is that the browser counts as a trusted controller too.

The proof of concept is an extension that registers a MAIN-world content script on claude.ai. MAIN world means the script runs inside the page's own JavaScript context, with the page's session, rather than in the isolated sandbox extensions normally get. From there it:

1. Opens Dispatch in a tiny, unfocused popup the user is unlikely to notice.
2. Calls GET /v1/sessions?tags=cowork-dispatch-local with the user's cookies to get the session ID of the user's Claude Desktop agent.
3. Sends prompts into that session. The test used four, asking Claude to install an npm package. Claude hesitated at first, and a follow-up written in the user's voice talked it round.
4. Clicks any visible "Allow" button once a second. Claude Desktop asks before acting, but those approval prompts render in the web page the extension controls.
5. Reads Claude's replies and rewords the next prompt until the command runs.

In Forever's test the final action was npm install -g of a package whose install script opened Calculator. The researchers point out the same step could steal files or install a backdoor. No browser exploit is involved: the extension only uses what claude.ai already lets a signed-in page do.

The attack needs the user signed in to claude.ai in the browser and to Claude Desktop with Dispatch on, with the computer awake and the desktop app open. The extension does not have to start out malicious. Forever lists a legitimate extension that ships a compromised update, or one with its own security bug, as equally good entry points.

Why the reach matters

On one machine, ThisBash turns script access to a web page into command execution on the operating system. Because Dispatch links devices, the same extension could also direct Claude Desktop on a different computer signed in to the same Claude account. Forever describes that cross-device case without demonstrating it.

The case that should worry IT teams is the personal account. Dispatch is offered on individual Pro, Max and Ultra plans, and Forever says it has seen personal Claude accounts with cross-device Dispatch enabled on corporate endpoints at its customers. An extension in someone's home browser could then reach their work laptop, outside anything the company manages.

Forever also says Claude Code Remote Control and Claude Cowork sessions, which are shared between the web and the desktop app, let an extension carry out the same attack. The researchers have not published tests of those two features yet and promise a follow-up post. Treat that as likely but unconfirmed. Their summary: "Anthropic is retiring Dispatch, but not the design behind it."

Disclosure timeline

Forever's write-up and The Hacker News give the same dates. Forever reported the flaw on May 14, 2026. Anthropic accepted it as valid on May 19 and closed it as a duplicate of an issue it had already found internally. On October 13 Anthropic told the researchers Dispatch would be retired, targeting the end of October. The Register reports that Anthropic did not answer its questions about timing, and no source reports attacks in the wild.

What to do

No patch or fixed version exists, so these steps cut off the entry point and the target.

1. Stop using Dispatch where there is no business need. Forever's first recommendation is to disable cross-device Dispatch, and where it stays, to review how devices are paired, approved and removed. Anthropic's help page tells users to know how to disconnect or revoke access before enabling it but gives no steps, and we could not confirm them elsewhere. Since Dispatch only works while Claude Desktop is open and the machine is awake, quitting Claude Desktop on unattended machines closes the window in the meantime.
2. Block extensions from claude.ai. In Chrome, the ExtensionSettings policy's runtime_blocked_hosts field lists hosts whose pages an extension may not modify. Setting {"*":{"runtime_blocked_hosts":["*://*.claude.ai"]}} applies it to every extension without its own entry. If you deploy Anthropic's own Claude extension, give its ID a separate entry with runtime_allowed_hosts. Confirm the policy loaded at chrome://policy, where the ExtensionSettings status should read OK. The list takes at most 100 hosts.
3. Move to an allowlist. Set ExtensionInstallBlocklist to * and list approved IDs in ExtensionInstallAllowlist. Extensions already installed that are not on the list get blocked too, so build the list from your current inventory first. If you also use ExtensionSettings, it takes precedence over the two separate policies, so keep them consistent.
4. Audit what is already installed. Look for extensions that can register scripts on claude.ai: the scripting permission together with host access to claude.ai or all sites. Review updates that widen an extension's permissions instead of letting them through silently.
5. Find personal Claude accounts on work machines. Check which Claude Desktop installs are signed in to accounts outside your corporate sign-in. Those are where Dispatch can be on without your knowledge.
6. Check whether it already happened. Forever published no indicators. In your EDR (endpoint detection and response) tool, look for Claude Desktop starting npm install -g or other package installs, changing settings, touching credential files, or opening outbound connections it does not usually make. Any hit means treating the machine as compromised and rotating the credentials it held.

Approval prompts need their own channel

ThisBash works because the component that asks for an action can also click the button that approves it. Forever's advice for builders is to keep approval controls out of reach of whatever initiates the request. When you approve any AI agent for company use, ask which surfaces can send it instructions and where its approval prompts appear. If an approval can be clicked from a web page, any script on that page can click it.

Our safeguarding and hardening team builds the browser and endpoint policies described above, and our AI-native systems work reviews agent deployments for paths like this one. Open the chat and Yaali, our AI agent, will pass your question to an engineer.

Sources: Forever Security, ThisBash write-up, The Register, The Hacker News, GBHackers, Claude Help Center, Dispatch, Chromium ExtensionSettings reference, Google, Configure ExtensionSettings policy, Google Cloud, Chrome extension management.