Claude Dispatch: a browser extension on claude.ai can drive Claude Desktop into running commands (ThisBash); Anthropic closed it as a duplicate, no fix

View raw markdownEdit on GitHub ↗

TL;DR

Forever Security (Gal Weizman, 2026-11-04) reports that Claude Dispatch, the feature that lets a phone or browser hand tasks to Claude Desktop, accepted requests from any ordinary signed-in claude.ai session, so a browser extension with access to claude.ai could open the Dispatch page in a hidden window, address the user's desktop agent, send prompts until the agent ran a command, and click the approval buttons itself. The researcher's proof of concept installed an npm package and opened Calculator on the desktop; the same path runs anything. Per the researcher, Anthropic acknowledged the report on 2026-05-19, closed it as a duplicate of an internally known issue, paid no bounty, issued no CVE, and said on 2026-10-13 that Dispatch would be retired by the end of October. On 2026-11-05 the support page still lists Dispatch in limited beta. This file is unconfirmed because every statement about Anthropic's response is the researcher's account and no second firm has reproduced the chain.

What happened

The feature. Dispatch is part of Claude Cowork. Anthropic's support page says you message Claude from your phone and it works on your desktop, using local files, connectors, plugins and apps, and that development work is routed to Claude Code. It requires the Claude Desktop app and the Claude mobile app, is in limited beta on some Pro, Max and Ultra plans, and is closed to new users. The same page warns that an instruction from the phone can read, move or delete files and control the browser, and that malicious content could cascade into actions that are hard to undo.

The flaw as the researcher describes it. Claude Desktop is an Electron app built on the same web interface and API as claude.ai, and the Dispatch page, though not linked from the web version, accepted requests from an authenticated web session. A content script running on claude.ai with the user's cookies could therefore open the Dispatch view in a small unfocused window, find the local Claude Desktop session, submit prompts through the composer, read the replies, and adjust the next prompt (the researcher calls this prompt forcing). A script clicked the approval buttons, so no human confirmed anything. The payload was an npm install whose postinstall opened Calculator. The researcher names the missing control as an authorization boundary between the web session and the desktop agent, and points at OpenAI's Codex, which does not share sessions between web and desktop, as the contrast. The Register adds that Weizman's firm found personal Claude accounts on corporate endpoints at 18% to 71% of known Claude accounts in six organizations it examined, which is the cross-device case: a personal browser's extension reaching a work laptop's agent.

Prerequisites. A browser extension that can act on claude.ai (the proof of concept used a Manifest V3 content script and a host permission for all URLs), a user signed in to claude.ai in that browser, and Dispatch enabled with a Claude Desktop reachable through the account, on the same or another machine. No browser exploit and no further user interaction are needed. The researcher says Claude Code Remote Control and Claude Cowork sessions allow the same attack and promises a follow-up; this file records that as a claim, not a demonstration.

Timeline, per the researcher. 2026-05-14 reported to Anthropic. 2026-05-19 Anthropic acknowledged the findings and closed the report as a duplicate of an issue it had already found internally. 2026-10-13 Anthropic said Dispatch would be retired, targeting the end of October 2026. 2026-11-04 publication; the post says the flaw remains exploitable until Dispatch is retired. The Register (2026-11-05) says Anthropic did not respond to its questions, including when Dispatch would be retired, and that the support page still listed Dispatch on 2026-10-30. Read on 2026-11-05, the support page lists it in limited beta and shows "Updated this week" with no date.

Why this is a vibe-coding file. The desktop agent Dispatch addresses is the one that routes development work to Claude Code, so the command runs with the developer's files, shell, cloud credentials and connectors. The delivery vehicle is a browser extension, which is the channel this corpus already tracks for BragJack and ClaudeBleed. The difference is that the extension does not need Claude for Chrome installed: any extension with access to claude.ai will do, and the extension stores have shipped malicious ones every month this year.

Am I affected?

  1. Is Dispatch on? In Claude Desktop, open the Cowork side panel and look for Dispatch. If it is present and paired with your phone, you are in the described configuration until Anthropic retires it or ships a fix.
  2. Which extensions can act on claude.ai? In Chrome, chrome://extensions, open each extension's details and read its site access: "On all sites" or an explicit claude.ai entry is the prerequisite. In Firefox, about:addons, Permissions tab.
  3. Is the desktop you pair a work machine? If a personal Claude account on a personal browser is paired with a Claude Desktop on a corporate laptop, the extension population of the personal browser is now in the laptop's threat model.
  4. Look back. Review Claude Desktop and Claude Code session history for tasks you did not dispatch, and the shell history of the desktop for npm install, npx, curl | sh or similar commands around sessions you do not recognise.

If you are affected

  • Turn Dispatch off, or unpair the mobile app, until Anthropic publishes a fix or confirms the retirement. The researcher's advice is to disable cross-device dispatch where there is no business need.
  • Remove browser extensions you cannot vouch for from any browser signed in to claude.ai, and move claude.ai into a browser profile with no third-party extensions.
  • If a session ran a command you did not dispatch, treat the desktop as compromised: follow if your local AI agent was exploited and rotating cloud credentials for every key the desktop held.
  • Do not pair a personal Claude account with a corporate desktop. Bring agents under corporate SSO where the plan allows it.

Prevention

  • Approval prompts that the request initiator can click are not approvals. A control that stops a prompt-injected agent has to live where the page's scripts cannot reach it. See agent sandboxing.
  • Treat browser extensions as endpoint software: review permissions, control installation, and re-review when permissions change. See credential hygiene.
  • Monitor agent activity on developer machines for unexpected package installs, configuration changes, credential reads and new outbound connections.

Update 2026-11-06 — The Hacker News reports the same research; Anthropic gave it no statement; the support page says Dispatch "isn't available to new users" and nothing about retirement

The Hacker News (2026-11-06, Swati Khandelwal) carries Forever Security's findings with the same timeline (report accepted as valid 2026-05-19, closed as a duplicate of an internally known issue, retirement targeted for the end of October per the researchers) and says the researchers consider the flaw still exploitable. It contains no Anthropic statement; every vendor position in it is still the researcher's account, so the file stays unconfirmed. The support page, re-read the same day, says Dispatch is "in limited beta on some Pro, Max, and Ultra plans", "isn't available to new users", and that existing users "can keep using it for now"; it does not mention retirement, deprecation or an end date, and still shows "Updated this week" with no calendar date. The end-of-October retirement the researchers were told about has not happened on the page's evidence.

Sources