A security flaw in Claude Dispatch lets a browser extension turn the desktop assistant into a remote-control tool, and Anthropic has known about it since May. The flaw, found by security researcher Gal Weizman of Forever Security and named ThisBash, lets an extension that can control the Claude website send commands to Claude Desktop as if they came from the user. Anthropic accepted the report as a real vulnerability, then closed it without a fix and said it would retire Dispatch instead. That retirement was due by the end of October. Dispatch is still running.
## How the attack works
Dispatch exists so people can send work from a phone or a browser to Claude Desktop, an agent that runs commands and works with files on the computer. Weizman found the feature’s interface was also reachable from an ordinary logged-in session on the Claude website, even though the site shows no link to it.
An extension able to control that page could therefore use Dispatch as its owner would, sending instructions to the desktop agent with the user’s own session behind them. The attack needs no browser exploit and almost no action from the person at the keyboard. The only visible trace is a small popup window opening the Dispatch page.
In the proof of concept, the extension opened Dispatch in a tiny unfocused window, fetched the desktop agent’s session, and sent four written prompts. Claude hesitated at installing an unfamiliar package, so the script reassured it in the user’s voice until it agreed. Automated clicks approved the prompts, and the package installed, opening a calculator as proof the code ran.
Neither the research nor the reporting describes any attack using the flaw in the wild. The proof of concept opened a calculator; a real attack could steal source code and cloud credentials, install a backdoor, or encrypt files on the machine instead.
## The cross-machine problem
On one computer, the flaw is a sandbox escape: a browser extension reaches past the browser and runs code on the machine hosting it. Dispatch is built to work across machines, so the desktop receiving the instructions can sit on a different computer signed into the same account.
The browser becomes a remote entry point, and the extension’s location no longer decides where the damage lands. That matters most where personal and work machines share one Claude account: an extension on a home browser could reach a work laptop holding source code and cloud credentials.
The exposure is not theoretical at the edges. The Claude website draws about 950 million visits a month, and Anthropic’s own data counted 1.2 million sampled Cowork sessions across more than 600,000 organisations in May. Forever Security found personal Claude accounts on corporate machines at rates from 18 to 71 percent across six organisations it studied.
## What Anthropic said — and didn’t
Weizman reported the flaw to Anthropic on 14 May 2026, and the company acknowledged it as a valid vulnerability five days later. It then closed the report as a duplicate of a flaw it was already tracking, paid no bug bounty, and issued no CVE identifier.
Anthropic told the researcher it planned to retire Dispatch by the end of October. That date passed, and the feature is still listed as available in limited beta for some Pro, Max and Ultra subscribers, closed to new users. Anthropic did not answer questions about when the feature will go, or about the flaw itself.
## The flaw outlives Dispatch
Retiring Dispatch would not settle the matter, the researcher argues, because the underlying design is shared by other Claude features. [Claude Code](https://geroundtable.com/claude-code-game-clone-rule/) Remote Control and Cowork sessions let the web drive an agent on the machine by design, so the same attack could be rebuilt on those surfaces. Anthropic’s help pages describe Cowork sessions as shared between web and desktop.
## Our read
The troubling part of this story is not that a flaw exists, but that Anthropic chose to live with it. A six-month-old report, confirmed, with no fix, no CVE and a missed retirement date, is a decision, not an oversight. The researcher offered one fix: treat the web as a weaker device than the desktop. Anthropic has not taken it.
The contrast with OpenAI is instructive. Its Codex keeps web and desktop sessions separate, so a compromised browser tab cannot reach a desktop agent at all. Anthropic built the opposite: one continuous session across phone, web and desktop, which is convenient and, as this research shows, porous. Convenience won the design argument, and the security bill is still open.
The contrast is sharpest against OpenAI’s own security work. Its [GPT-6 Cyber](https://geroundtable.com/gpt-6-cyber-critical-security-model/) model found 81 new Firefox flaws and built working exploits for 948 Linux kernel bugs, a programme built on hunting vulnerabilities rather than living with them. Anthropic, facing a flaw in its own product, chose retirement over repair — and then missed the retirement too.
## Why It Matters
For Claude users, the practical advice is narrow but urgent: treat browser extensions as endpoint software, not harmless add-ons, and switch off cross-device Dispatch where there is no business need for it. A malicious or hijacked extension is the only ingredient the attack requires, and extensions with broad permissions are already common in workplaces.
For the industry, the story is a warning about what connected agents quietly trade. Every bridge between a low-privilege surface and a high-privilege agent is a new trust boundary, and Anthropic’s design treats a logged-in web session as proof the user authorised a desktop command. Until vendors price that trade honestly, users will keep discovering it through research like this.
## Background
Anthropic, founded in 2021, has built Claude from a chat assistant into a platform spanning coding, agents and workplace tools, with Dispatch and Cowork linking its phone, web and desktop versions into one continuous session. The company is also preparing a public listing, having filed for an [initial public offering](https://geroundtable.com/anthropic-ipo-investor-doubts-valuation/) in October.
Source: [The Register](https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684), [the researchers’ write-up](https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce)
0 Comments