An alarming security weakness discovered in Anthropic’s Claude Dispatch allows malicious browser extensions to execute commands on connected computers through Claude Desktop. This vulnerability could potentially affect other devices logged into the same Claude account.
Research Findings and Publication
The security issue was identified by researcher Gal Weizman from Forever Security. Named ThisBash, the findings were published on November 4, 2026. Although Anthropic plans to phase out Dispatch, the underlying design persists in other Claude functionalities.
Claude Dispatch enables users to send tasks from their mobile devices to Claude Desktop, an AI agent that interacts with local files and applications. The feature, still in limited beta and closed to new users, may pose risks as manipulated instructions could trigger irreversible actions.
Details of the Vulnerability
The vulnerability does not originate from the phone-to-desktop connection but rather from interactions via claude.ai in a browser. This is where extensions can operate alongside the page, compromising security.
Claude Desktop, an Electron application, shares its web interface and API with claude.ai. While the web version concealed the Dispatch link, it did not block access, allowing any logged-in browser tab to open Dispatch and send requests. Extensions capable of running scripts on claude.ai could exploit this using the user’s cookies.
Implications and Potential Exploits
Researchers demonstrated that a script could open Dispatch in a small background window, obtaining the session ID of the user’s desktop agent. Despite initial resistance to installing unknown packages, prompt forcing allowed the script to persist until success. This method involved minimal visible traces on the screen.
Once executed, the package could perform actions like opening applications, copying files, or planting backdoors. The cross-device nature of Dispatch means that commands could originate from a different device, posing a threat to enterprise environments where personal and work accounts might intermingle.
Protective Measures and Future Outlook
To mitigate such threats, organizations should maintain a list of AI agents and their associated accounts, ensuring they are linked via company single sign-on. Disabling cross-device remote control where unnecessary and monitoring device pairing can enhance security.
It is crucial to treat browser extensions like any software, limiting installation permissions and monitoring updates. Approval prompts should not be self-executable by requesting components. Teams should be vigilant for unusual package installations or configuration changes linked to agent activities.
Anthropic has introduced a beta EDR monitoring option for Claude Cowork on Team and Enterprise plans, assisting in identifying suspicious activities. A key preventative measure is maintaining a strict separation between personal and work accounts on devices.
ThisBash underscores the importance of robust security practices, emphasizing the need for vigilance with AI tools and browser extensions. Integrating threat intelligence and providing alert contexts can significantly enhance incident response capabilities.
