Browser extensions could make Claude Desktop run commands through Dispatch, researchers say

Security firm Forever Security has shown that a browser extension with access to claude.ai could use Dispatch, a remote-task feature of the Claude Desktop app, to make the user's computer install and run software without the user noticing. It affects existing Dispatch users who are signed in to claude.ai in a browser that also runs extensions; no attacks in the wild have been reported. If you use Dispatch, review which extensions can read claude.ai, turn off cross-device features you don't need, and keep personal Claude accounts off work machines.

What happened, in plain English

Claude Desktop is Anthropic's desktop app. Through its Cowork mode, Claude can act on your computer: read and edit files, use your apps and connectors, and run commands. Dispatch is a feature that lets you message Claude from your phone and have it carry out the task on your desktop computer, as long as that computer is awake and the app is open.

On November 4, 2026, Forever Security researcher Gal Weizman published a write-up the company calls "ThisBash." The researchers found that Dispatch was not only reachable from the phone app. An ordinary signed-in session on the claude.ai website could also use it, even though the website showed no link to it. Hiding the button did not lock the door.

That matters because of browser extensions. Many extensions are allowed to "read and change data" on the websites you visit. An extension with that permission on claude.ai, whether malicious from the start, taken over through a bad update, or simply buggy, could open Dispatch in the background, send Claude instructions as if they came from you, and click the approval buttons itself.

A simple analogy: you gave your house keys to a trusted assistant who takes orders by phone. It turns out anyone who could reach your desk phone could also call the assistant, and the assistant could not tell the difference.

In the researchers' test on one computer, the extension persuaded Claude to install a software package; Claude hesitated at first, but follow-up messages written as if from the user got it to proceed. The package opened the Calculator app as a harmless stand-in for a real payload. The researchers report no real-world attacks.

Are you affected? What to do now

Most readers have nothing urgent to do. Anthropic's help page says Dispatch "is in limited beta on some Pro, Max, and Ultra plans, and it isn't available to new users." You are in scope only if all of these are true:

• You (or your users) already have Dispatch set up in Claude Desktop;
• the same Claude account is signed in on claude.ai in a browser;
• that browser has at least one extension allowed to run on claude.ai (many extensions request access to "all sites").

According to the researchers, Anthropic accepted the report in May 2026 and told them on October 13, 2026, that Dispatch would be retired, targeting the end of October. As of November 9, 2026, Anthropic's help page does not mention a retirement; it says existing users "can keep using it for now". We found no public statement from Anthropic on the research. Treat the issue as unresolved until Anthropic says otherwise. No CVE has been assigned.

Checklist

• Find out whether Dispatch is in use. In Claude Desktop, look for Dispatch in the Cowork side panel, and check whether a phone is paired. If you don't use it, sign the phone app out of the pairing or stop using the feature.
• Review extensions that can see claude.ai. In Chrome or Edge, open the extensions page (chrome://extensions or edge://extensions), open Details for each extension and check Site access. Remove extensions you don't need; set the others to "On click" or to specific sites that don't include claude.ai.
• Use a separate browser profile for AI tools. A profile with no extensions, used only for claude.ai, removes the precondition.
• For IT administrators: manage extensions through browser policy. Chrome and Edge let you allowlist extensions and block them from running on chosen sites (the ExtensionSettings policy with runtime_blocked_hosts), for example *://claude.ai.
• Keep personal AI accounts off managed devices. The researchers say they saw personal Claude accounts with cross-device Dispatch enabled on corporate computers at customer sites. That links a home browser to a work laptop.
• Watch what agents do. Alert on unexpected package installs, configuration changes, credential access and new outbound connections from machines that run desktop AI agents.
• Close Claude Desktop when you don't need it. Dispatch only works while the computer is awake and the app is open.

No indicators of compromise have been published.

The expert view

The root cause is an authorization assumption, not a memory-corruption bug. Dispatch was designed around a paired phone talking to a desktop agent; the researchers note that peer-to-peer path showed no flaw. The weakness was that the same backend also trusted the generic claude.ai web session. As the write-up puts it, "an authenticated web session is not, by itself, evidence that the user authorized a command on their machine."

Two familiar defenses failed together. First, hiding a feature in the user interface is not access control; if the API accepts the session, anything that holds the session can call it. Second, human-in-the-loop approval only helps if the approval dialog is out of the attacker's reach. Here the approval buttons lived in the same web page the extension controlled, so a click proves nothing about intent.

The attack chain, conceptually: extension code runs inside the claude.ai page, inherits the user's session, finds the user's desktop agent, sends a sequence of instructions, and approves the resulting actions. The researchers call the middle step "prompt forcing": rather than hiding a single injected instruction in a document, an attacker who owns the input channel can simply negotiate with the agent over several turns until a hesitant model complies. Model-level refusals are a speed bump in that scenario, not a boundary.

This fits a pattern we have seen all autumn: the risk in agentic AI products increasingly sits in the plumbing around the model — embedded browsers, extensions, remote-control channels, local servers — rather than in the model. A browser extension, already one of the least governed pieces of corporate software, becomes a path to code execution on the endpoint, and potentially on other endpoints signed in to the same account.

Severity in context: no CVE or CVSS score has been published. The impact if exploited is high (code execution with the user's rights, possibly across devices), but the preconditions are real limits: a hostile or compromised extension with claude.ai access, an existing Dispatch user, and a desktop that is awake with the app open. With Dispatch closed to new users, the exposed population is shrinking. We'd rate it a serious design issue with limited current reach, not a mass-exploitation risk.

What is still unknown: whether Dispatch has actually been retired or blocked server-side; whether Anthropic has changed how Dispatch authenticates web sessions; and whether, as the researchers claim but did not demonstrate, Claude Code Remote Control and Cowork sessions are exposed to the same pattern. In their words, "Anthropic is retiring Dispatch, but not the design behind it." Forever Security says a follow-up post is planned. Anthropic has not publicly commented on those claims.

Official sources

• Forever Security (Gal Weizman), "ThisBash" — Claude Dispatch browser extension write-up, November 4, 2026: https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce
• Anthropic Help Center, "Assign tasks from anywhere in Claude Cowork" (Dispatch): https://support.claude.com/en/articles/13947068-assign-tasks-from-anywhere-in-claude-cowork
• Coverage: The Hacker News, "Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers," November 6, 2026: https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html