Threat
Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers
First reported thehackernews.com
Page published
Earliest dated coverage: 6 Nov 2026 · First observed: 6 Nov 2026 · Latest dated coverage: 6 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Claude Dispatch exposes a path from browser-extension access to local command execution through an AI agent, making extension permissions relevant to endpoint security.
Forever Security researchers demonstrated that a browser extension able to run scripts on claude.ai could abuse Claude Dispatch to make Claude Desktop execute code on a user's computer. Dispatch accepted an ordinary signed-in website session, allowing the extension to submit instructions as though they came from the user. Researchers reported that the flaw remained exploitable despite Anthropic's stated plan to retire Dispatch.