Anthropic Claude Dispatch · Exploitation reported

Claude Dispatch flaw remains exploitable; Anthropic to retire feature

Nov 05, 2026 · 2 min read

Forever Security researchers demonstrated that a browser extension able to control claude.ai can use Claude Dispatch to make Claude Desktop run code on the system, even on another machine on the same account. The flaw, reported to Anthropic on May 14, 2026, and acknowledged as valid, remains exploitable; Anthropic says Dispatch will be retired, targeting the end of October 2026. Restrict the feature and govern browser extensions and AI agents on endpoints.

By HIFY Radar newsroom Updated 11/06/2026 10:13 AM Get this every day →← Back to the feed 4 sources

HighVulnerabilityExploitation reportedUnpatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

Forever Security researchers demonstrated that a malicious browser extension can use Claude Dispatch to make Claude Desktop run commands on the computer, with no browser exploit. Anthropic acknowledged the May 14, 2026 report as valid, and the flaw remains exploitable. Anthropic says Dispatch will be retired, targeting the end of October 2026.

Why it matters

An employee's personal Claude account signed in on a work laptop can give a browser extension a path to run code next to source code and cloud credentials. The attack also reaches a different machine signed into the same Claude account. The researchers say other features, such as Claude Code Remote Control and Claude Cowork sessions, allow the same attack by design.

What to do

Restrict Claude Dispatch use until the feature is retired and review which browser extensions and AI agents run on corporate endpoints. Audit personal Claude accounts signed in on work machines. Watch for Anthropic announcements and the researchers' promised follow-up.

For the technical team

Affected: Anthropic Claude Dispatch · Claude Dispatch (Claude feature); per the researchers, Claude Code Remote Control and Claude Cowork sessions share the same trust pattern. No versions cited in the sources.
Exploitation: Public proof of concept from Forever Security, in the 'ThisBash' writeup; no reports of in-the-wild exploitation. The flaw remains exploitable until Dispatch is retired, targeted for the end of October 2026.
Fix: No patch cited in the sources. Anthropic says Dispatch will be retired, targeting the end of October 2026; the researchers say removing the feature does not address the issue fundamentally.
Vector: Claude Dispatch: interface and API reachable from an ordinary authenticated claude.ai session. A browser extension permitted to control the site submits commands to Claude Desktop as if from the user; four prompts and auto-clicked 'Allow' buttons got Claude to install a package that opened Calculator, with prompt forcing overcoming hesitation. No browser exploit; requires Claude Desktop connected to the account.
More details: Reported to Anthropic on May 14, 2026, and acknowledged as valid; per IntCyberDigest, Anthropic closed the May report as a duplicate. Impact ladder: sandbox escape on one machine, cross-machine RCE, organizational infiltration with a personal account on a work laptop. The demo clicked 'Allow' every second until Claude installed a malicious npm package; the remote shell works on another machine on the same account. Per Forever, the root cause is an architecture that treats an authenticated web session as authorization for local commands; a follow-up blog is promised.

Timeline

11/06/2026 10:13 AM
Forever Security researchers show a browser extension running scripts on claude.ai can make Claude Desktop run code; the flaw remains exploitable.
11/06/2026 09:56 AM
New detail: the demo clicks "Allow" every second until Claude installs a malicious npm package, and the remote shell also works on another machine on the same account; Anthropic closed the May report as a duplicate.
11/06/2026 09:34 AM
A writeup dubbed 'ThisBash Escape' technically details the sandbox escape that lets extensions run code on the operating system.

Want the next updates in your inbox? Get the daily edition →

See all 5 updates

11/05/2026 11:57 AM
Researcher details the chain: the flaw was reported to Anthropic in May and lets an extension abuse an authenticated session to run code on the underlying OS through connected Claude Desktop.
11/05/2026 11:48 AM
First disclosure: researcher announces the Claude Dispatch flaw, covered by The Register.