Forever Security Showed a Browser Extension Could Use Claude Dispatch to Make Claude Desktop Run Code, Even on Another Computer. Dispatch Is Being Retired. Here Is What to Check Today.
If anyone on your team uses Claude Desktop with Dispatch turned on, turn Dispatch off until Anthropic's retirement is confirmed, and list which browser extensions can read or change claude.ai. Forever Security, an endpoint security company, showed that an extension able to run scripts on claude.ai could send Claude Desktop instructions through Dispatch as if the user had typed them, and get it to install a package. The researchers say the flaw could still be exploited when they published. No real attacks have been reported.
What Forever Security reported
Dispatch lets people send tasks from their phone or browser to Claude Desktop, an agent that can run commands on the computer where it is installed. Gal Weizman of Forever Security published the research on November 4, 2026 and calls the attack ThisBash. The finding is that Dispatch's interface and API were also reachable through an ordinary signed-in session on claude.ai, even though the site showed no link to it. So a browser extension with permission to run scripts on claude.ai could use it to submit instructions to Claude Desktop as though the user had sent them.
In the test, a script on the user's claude.ai page opened Dispatch and sent four prompts asking Claude to install an npm package. Claude hesitated over the unfamiliar package, but a follow-up message in the user's voice, which the researchers call prompt forcing, got it to go ahead. Claude asks before it acts, but those approval prompts appeared in the web page the extension controlled, and the script clicked every "Allow" button once a second. Claude then ran a global npm install, and the package's install script opened the Calculator app. No browser exploit was needed.
Three conditions are needed. The extension could be malicious, a legitimate one that received a bad update, or one with its own flaw. The person must be signed in to both claude.ai and Claude Desktop with Dispatch on. And, according to The Hacker News, Dispatch works only while the computer is awake and the desktop app is open. Because Dispatch links devices, the desktop that receives the instructions can be a different computer from the one running the extension. The test used one computer.
Status
Forever Security says it reported the flaw to Anthropic on May 14, 2026 and that Anthropic acknowledged it as valid. The researchers say Anthropic told them Dispatch would be retired, with the end of October as the target. According to The Hacker News, Anthropic's Dispatch help page, last updated late last week, does not mention a retirement. It says Dispatch is closed to new users and that existing users on some Pro, Max and Ultra plans "can keep using it for now." We have not seen a statement from Anthropic beyond what those two sources quote.
The researchers also argue the problem is wider than one feature: that an authenticated web session is not by itself evidence that the user approved a command on their machine, and that Claude Code Remote Control and Cowork sessions share the pattern. That is their claim, with a follow-up post promised. We have not tested it.
What to do
- If you use Dispatch, turn it off until the retirement is confirmed in writing.
- List the extensions installed in the browsers your team uses and find those with permission to read and change data on claude.ai. Remove any that are not needed. On managed browsers, use an allowlist.
- Keep personal and work accounts apart. The researchers' worst case is an employee signed in to a personal Claude account on a work laptop.
- Treat an AI agent that installs software as an event worth logging. Alert on Claude Desktop starting a package install, such as a global npm install, that no one asked for.
- Do not approve actions in a window you did not open yourself.
The last three steps are our reading of the research. Forever Security's own recommendations are in its write-up.
What is not known
Whether the flaw is still exploitable today, since the researchers' statement is from earlier this week. Whether Anthropic has changed Dispatch since. Whether Remote Control and Cowork can be driven the same way. How many people use Dispatch. The report publishes no indicators; the test package is a harmless proof of concept, so nothing goes in the feed and we ingested nothing.
Limits
We read Forever Security's write-up in full and The Hacker News's summary. We did not run the attack. DugganUSA builds with Claude and says so; this is a report of third-party research about a product we use, and we have tried to state it no more and no less strongly than the researchers do. We covered a different finding from the same firm last week (https://www.dugganusa.com/post/ai-dev-tools-embedded-browser-flaws-codex-vscode-chatgpt).
Five percent of this is wrong somewhere. It always is. If Anthropic has said more, we will add it.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.