Claude Dispatch Flaw Lets Browser Extensions Run Code

A Claude Dispatch flaw lets a browser extension that can run scripts on claude.ai make Claude Desktop execute code on a user's computer, security firm Forever Security has shown. No browser exploit is needed, and the researchers say the issue stays exploitable for as long as Dispatch remains switched on, although no attacks in the wild have been reported.

How does the Claude Dispatch attack work?

Dispatch is a Claude feature that lets people send tasks from a phone or browser to Claude Desktop, an AI agent that can work with local files and run commands. Researcher Gal Weizman found that its interface and API were also reachable from an ordinary signed-in session on claude.ai, even though the site showed no link to it. In his technical write-up, published on November 4 under the name ThisBash, a script injected by an extension opened Dispatch in a tiny popup, grabbed the desktop session ID and typed four prompts in the user's voice.

Claude first hesitated over an unfamiliar npm package. A follow-up message talked it round, and the script clicked every "Allow" button once a second, so nobody had to be watching. The package's install script then opened Calculator. The same step could have stolen files or planted a backdoor, the researchers say, because the agent runs with the user's permissions.

Who is at risk?

Several conditions have to line up. The attack needs an extension that can script claude.ai, whether malicious, hijacked through a bad update or simply buggy. The user must be signed in to both claude.ai and Claude Desktop with Dispatch enabled, and the computer has to be awake with the app open.

Detail	Status
Reported to Anthropic	May 14, 2026
Anthropic response	Accepted as valid, closed as a duplicate of an internal finding
Fix plan	Dispatch to be retired, targeted for end of October
CVE or public exploit	None
Attacks in the wild	None reported

Because Dispatch links devices, the researchers say an extension could also reach Claude Desktop on a different computer signed in to the same account, such as a work laptop. That case was described but not demonstrated. Dispatch is already closed to new users, but some Pro, Max and Ultra subscribers still have it.

What should Claude users do now?

Turning off Dispatch, or signing out of Claude Desktop on machines that do not need it, removes the path. Auditing browser extensions with access to claude.ai matters just as much, since the attack starts there. The researchers warn that the root problem, treating a logged-in web session as proof that the user approved a local command, also applies to Claude Code Remote Control and Cowork sessions. It is the second AI-agent security scare this week, after hundreds of Artex AI hacking consoles were found open online.

Our Take

This is less a classic bug than a design gap, and that makes it harder to patch away. As AI agents get the keys to our files and terminals, every extension that touches the chatbot's web page becomes part of the security boundary. The timing is awkward for Anthropic as it fields investor questions over its IPO valuation, and the fix it chose, retiring Dispatch, leaves the wider trust model untouched. Our advice for readers in Türkiye and everywhere else is simple: keep extensions to a minimum on any browser signed in to an AI agent.