Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries

Summary

ThisBash is a researcher-reported Claude Dispatch vulnerability that turns control of an authenticated Claude browser session into commands executed by a connected Claude Desktop agent. The Register attributes the discovery to Forever Security researcher Gal Weizman and describes a proof of concept that crossed the browser-to-operating-system boundary without exploiting a browser vulnerability. The demonstrated starting point is already significant: a malicious or compromised extension must be able to control claude.ai, and the account must expose a reachable desktop-agent session. The supplied evidence describes research, not an observed intrusion campaign.^[0]

The proof of concept discovers the desktop session through the web interface, repeatedly prompts the agent to perform an installation, and automatically clicks approval controls. Its npm-package installation hook opens the calculator application, demonstrating operating-system execution rather than an observed malware deployment. The potential execution target is not necessarily the browser's host: Dispatch can reach another connected computer, creating a conditional path from a personal browser session to a corporate desktop when account access bridges those environments.^[0]

According to the report, Anthropic acknowledged the May 2026 submission as a valid vulnerability but closed it as a duplicate. The company reportedly planned to retire Dispatch at the end of October, yet the November 5 article says that had not happened and identifies no fix or CVE. Weizman further argues that shared Cowork sessions and Claude Code Remote Control preserve the underlying trust-boundary weakness. Those broader claims, the disclosure history, and the technical demonstration are all supported here by a single news report; separate vendor correspondence and primary technical documentation are not supplied.^[0]

Attack chain

1. 1. Establish extension-controlled execution in the Claude web session: The demonstrated chain assumes an extension with access to claude.ai, a user authenticated to Claude on the web and desktop, and Dispatch enabled for the reachable desktop agent. The extension registers a MAIN-world content script that runs in the page's JavaScript context. Installing a malicious extension or compromising an existing extension is described as a possible prerequisite, not as an observed delivery event.^[0]
2. 2. Open the Dispatch interface: The script opens Dispatch in a tiny, unfocused popup. The technical account quoted by the article describes this popup as the only visible trace of the exploitation sequence.^[0]
3. 3. Discover the connected desktop-agent session: The script sends GET /v1/sessions?tags=cowork-dispatch-local using the user's ambient session cookies. The response supplies the session identifier for the Claude Desktop agent, allowing the extension to address the connected execution environment.^[0]
4. 4. Submit and reinforce execution requests: The script places prompts into the composer and continues the conversation with the agent. In the reported demonstration, prompts request an npm-package installation through Claude Code and provide reassurance when the agent questions the request. The researcher calls this repeated interaction force prompting.^[0]
5. 5. Automate approval: A one-second interval repeatedly clicks Allow controls whenever they appear. This keeps browser-rendered approval questions from stopping the sequence when the legitimate user is not watching.^[0]
6. 6. Continue until desktop execution occurs: The script repeats and rephrases requests until the agent performs the requested action. In the proof of concept, a global npm installation runs a package's preinstall.js hook, which opens the calculator application. The report presents credential theft, source-code theft, and backdoor installation as possible malicious outcomes, not as observed results.^[0]

Disclosure timeline

How it works

The central weakness is a trust-boundary crossing between a browser-controlled session and a desktop agent with operating-system capabilities. Dispatch deliberately lets an authenticated user direct desktop work remotely. The proof of concept abuses that legitimate control path from an extension-controlled web session, converting browser-level access into the desktop agent's ability to access files and run commands. It is not described as an unauthenticated endpoint exploit or a browser memory-corruption exploit.^[0]

Session discovery supplies the bridge to the execution target. A MAIN-world script uses the authenticated page context to request sessions tagged cowork-dispatch-local and obtain the desktop-agent session identifier. The described mechanism relies on requests carrying ambient authentication; the report does not establish that the extension must extract cookie values or separately compromise the desktop application.^[0]

The agent's conversational caution does not provide a dependable stop in the demonstrated chain. Because the extension retains control of the conversation, it can rephrase requests, provide reassuring context, and continue asking for the desired action. The researcher's description of success as 'when, not if' is an assertion about this technique, not a supplied measurement of success rates across deployments.^[0]

Browser-visible approval is also within the extension's control. The proof of concept repeatedly clicks Allow at one-second intervals, so a displayed approval question does not necessarily represent an independent human authorization decision. This is an important distinction from an attack that succeeds only after a user knowingly approves the final desktop command.^[0]

The execution demonstration uses an npm installation lifecycle hook to open the calculator application. This establishes code execution through the desktop agent's available capabilities, but the report does not demonstrate administrator or root privilege acquisition. More damaging payloads are discussed as potential consequences rather than observed activity.^[0]

The boundary crossed depends on the connected desktop. A same-machine target allows browser-originated control to reach the host operating system; a different connected desktop allows the browser to become a remote entry point. Crossing into a corporate environment is conditional on the compromised account session being able to control that corporate desktop. Weizman argues that shared Cowork sessions and Claude Code Remote Control extend the same underlying design concern beyond Dispatch.^[0]

Affected versions and patch status

Key takeaways

• This is a proof-of-concept vulnerability account, not evidence of an active exploitation campaign. The demonstrated result is calculator execution; the report's malware and corporate-intrusion scenarios are potential consequences.^[0]
• The important escalation is from control of a legitimate authenticated web session to the operating-system capabilities of a connected desktop agent. The target can be remote, but only if the compromised session can reach it.^[0]
• Conversational resistance and approval buttons inside an extension-controlled browser interface did not stop the demonstrated sequence: the extension could continue prompting and automatically approve requests.^[0]
• Remediation status remains incompletely established in the supplied evidence: no fixed versions are identified, the reported retirement plan was not completed, and broader Cowork and Remote Control exposure is attributed to the researcher. All incident-specific findings rely on one supplied report.^[0]

Defensive actions

• Review and restrict browser extensions that can access or control claude.ai on accounts connected to desktop agents.: Extension control of the Claude web session is the attack's stated prerequisite. The report identifies both malicious-extension installation and compromise of a legitimate extension as possible ways to obtain that control; it does not require a browser exploit.^[0]
• Review which desktops an account can control, and separate personal-browser access from accounts or sessions that can command corporate desktops.: The cross-corporate scenario depends on a compromised browser session reaching a connected work computer through shared account access. Reviewing that linkage addresses the specific bridge described in the research rather than assuming the browser host is the only exposed machine.^[0]
• For product owners, treat web-originated requests as lower-trust and restrict their ability to initiate desktop operating-system actions.: This follows Weizman's proposed remediation: recognize the web client as a different device with inferior security permissions and block actions outside that client's permitted scope. The article presents this as a design proposal, not as an existing administrator setting.^[0]
• For product architects, evaluate separating web sessions from desktop execution sessions rather than exposing the same session across clients.: The researcher identifies shared session access as the core enabler and cites a non-shared-session design as avoiding this particular problem. Session separation would address the described control path rather than relying only on the agent's responses or browser-visible approval prompts.^[0]
• Verify actual Dispatch availability and assess Cowork and Claude Code Remote Control paths rather than treating an announced Dispatch retirement as completed remediation.: The report says the planned retirement had not occurred by publication, while existing Dispatch users retained access under the quoted support status. The researcher also reports related exposure in other shared or remotely controlled sessions, so Dispatch retirement alone would not establish that the broader design issue was resolved.^[0]