Claude Dispatch flaw: browser extensions can run your code

A researcher has shown that a browser extension can use Claude Dispatch to make Claude Desktop run code on your computer. It can also be a different computer signed in to the same Claude account. The flaw is called ThisBash. It needs no browser exploit, just an extension with access to claude.ai and a user signed in to both the web app and Claude Desktop. If staff use personal Claude accounts on work laptops, this is about your company's machines.

What actually happened

Gal Weizman of Forever Security published the research on November 4. The Register covered it on November 5. According to Anthropic's help page, Dispatch lets you message Claude from your phone and have it work on your desktop with your local files, connectors and apps.

How the attack works:

• The opening. Claude Desktop is built on the same web interface and API as claude.ai. The web app hid the Dispatch link but didn't block access to it.
• The chain. An extension injects a script on claude.ai and reads the desktop agent's session ID through /v1/sessions with the user's cookies. It then sends prompts to that session. A loop clicks "Allow" on every approval prompt, once per second.
• The proof. The demo got Claude to npm install a package that opened Calculator. A real attacker could steal files or add SSH keys instead.
• The cross-machine part. Forever Security says it found personal Claude accounts with Dispatch enabled on corporate laptops. The Register reports personal-account shares of 18% to 71% across six customer organizations.

Per the researcher's timeline, Anthropic confirmed the report on May 19 and closed it as a duplicate of a bug it had already found. On October 13 it said Dispatch would be retired by the end of October. As of our check, the help page still lists Dispatch as a limited beta for existing users. The Register's headline says Anthropic "won't fix" it, but nobody quotes Anthropic saying so. Weizman says the same pattern works through Cowork and Claude Code Remote Control sessions.

Why the Claude Dispatch flaw matters for your business

Any AI agent that can run code on a machine can be reached through whatever controls the agent. Here, that's the browser. Clicking "Allow" isn't a security control if a script can click it.

1. Turn off Dispatch on any machine that doesn't need it, and sign out of Claude Desktop where nobody uses it.
2. Keep personal AI accounts off work laptops. Use company accounts under SSO so you can see and revoke them.
3. Treat browser extensions as installed software. Use an allowlist, and watch for updates that ask for new permissions. We've written about extension hijacks before.
4. Watch for surprise npm installs, new SSH keys and config changes on machines where agents run.

Sources: Forever Security, The Register, Anthropic.