Researchers from Forever Security have uncovered a significant security flaw involving browser extensions and Claude Dispatch, a feature of Claude Desktop. This vulnerability allows extensions to execute unauthorized code on users’ computers by leveraging the Dispatch functionality, which is still active according to the researchers.
Understanding the Vulnerability
The weakness lies in the Dispatch feature, which facilitates task transfers from mobile devices to Claude Desktop. Although Anthropic, the company behind Claude, plans to retire Dispatch, the researchers revealed that it remains exploitable as of now.
Claude Desktop acts as an AI agent capable of executing commands on the host computer. The researchers demonstrated that browser extensions running on claude.ai could send commands to Claude Desktop, mimicking user instructions. This capability allows extensions to potentially execute harmful operations.
Mechanics of the Exploit
To execute this attack, two critical conditions must be met: a browser extension that can run scripts on claude.ai, and a user signed into both claude.ai and Claude Desktop with Dispatch enabled. The extension could be either malicious or compromised, and it exploits Dispatch while the computer is active and the desktop application is open.
In a controlled test, the researchers demonstrated how a script on the claude.ai platform could activate Dispatch, prompting Claude Desktop to install an npm package. Despite initial skepticism, Claude executed the command following user-like prompts created by the extension. This exploit could lead to unauthorized actions, such as file theft or backdoor installations.
Recommendations for Users
To mitigate risks, users are advised to disable cross-device Dispatch unless essential. Reviewing how devices are paired and managing browser extension permissions are crucial steps to enhance security. Monitoring AI agent activities for unexpected actions is also recommended.
The researchers informed Anthropic of this flaw in May, and while the company acknowledged it, they marked it as a duplicate of an existing internal issue. Despite plans to retire Dispatch, similar vulnerabilities could persist in other Claude features.
As technological advancements continue, staying informed and vigilant about potential security threats is imperative for protecting personal and professional data.
