Anthropic’s “Claude Dispatch” feature contained a critical vulnerability that allowed malicious browser extensions to execute commands on machines connected via Claude Desktop—even on devices signed into the same account but located elsewhere. Discovered by security researcher Gal Weizman of Forever Security, the issue was disclosed on November 4, 2026. Although Dispatch is set to be retired, features built under the same design remain active.
How the Vulnerability Worked
Dispatch enables users to send tasks from a mobile device to Claude Desktop, an agent capable of interacting with local apps, files, and executing commands. While the link between phone and desktop proved intact, the vulnerability arose when the Dispatch workflow was triggered through claude.ai in a browser tab. That web interface—which shares code with Claude Desktop—didn’t hide access to Dispatch. Any logged-in browser tab could reach Dispatch via a URL if it carried user cookies.
Weizman’s proof of concept used a tiny 200×200 pixel window opened by an extension to fetch the session ID of the desktop agent. From there, the extension issued requests: after an initial prompt to install an npm package, the attacker used prompt forcing—manipulating the chat until Claude complied. A small loop automatically clicked ‘Allow’, enabling actions like opening the Calculator app. But more severe exploits, such as copying files, installing SSH keys, or planting backdoors, were possible.
Wider Implications & Risks
Because Dispatch supports cross-device control, a browser extension on a personal device can now send commands to another computer under the same account—potentially a work machine that holds sensitive code or keys. The vulnerability is especially concerning for users whose personal and professional accounts overlap or who use personal accounts on corporate endpoints. Research showed Dispatch remained enabled in many environments where endpoints were used, even under enterprise settings.
Browser extensions—particularly those with high permissions—are a common attack vector. A recent study found 99% of enterprise users have at least one extension installed; 53% have extensions with high or critical permissions. Normally, malicious extensions are limited to compromising browser content. This flaw, dubbed “ThisBash”, goes further by giving extensions control over the desktop.
What Has Been and Could Be Done
Anthropic was notified on May 14, 2026. By May 19 the company acknowledged the issue but marked it as a duplicate of an already known flaw. Dispatch was slated for retirement by the end of October 2026—though current publicly verifiable data doesn’t confirm if it has been fully disabled.
Even as Dispatch winds down, similar trust models underlie other Claude features such as Code Remote Control and Cowork sessions. These also allow the web to drive local agents, representing persistent risk. Weizman plans to publish follow-ups detailing how the same techniques could compromise those capabilities.
Recommendations for Users and Organizations
Start by inventorying AI agents in use and the accounts tied to them; ensure endpoints aren’t paired unnecessarily. Disable cross-device remote control where it isn’t required. Treat browser extensions as you would any other form of privileged software—limit installation permissions, audit what extensions request, review updates closely, and ensure no component can approve permissions by itself.
Anthropic now offers an EDR (endpoint detection and response) monitoring beta for Team and Enterprise Claude Cowork customers, which can help detect unusual agent activity. Most critically, separating personal AI use from work machines—and keeping personal accounts out of enterprise contexts—remains one of the strongest defenses.
Analysis: This vulnerability highlights a broader systemic risk in AI platforms enabling local‐agent control via remote web connections. Even as Dispatch is retired, the underlying trust gaps persist across Claude’s ecosystem. This case underscores the need for fundamentally more robust permission boundaries, more transparent audit logs, and stricter defaults—especially in cross-device AI integrations. What matters next is whether AI providers move faster than attackers in redesigning those boundaries.
