Malicious browser extensions can abuse Claude Dispatch to make Claude Desktop run code on users' computers
Researchers at Forever Security (Gal Weizman) showed that a browser extension able to run scripts on claude.ai can abuse Dispatch to make Claude Desktop run commands on the user's computer. Dispatch accepted an ordinary signed-in claude.ai web session, so the extension could send instructions as if the user had sent them. The researchers say the flaw can still be exploited. They report no attacks in the wild. This account comes from a news report of the researchers' write-up. No Anthropic advisory or CVE was found or named in the article.
Entenda a falha
A vulnerabilidade
Dispatch, a Claude feature that sends tasks from a phone to Claude Desktop, accepted an ordinary signed-in claude.ai web session, so a browser extension able to run scripts on claude.ai could send Claude Desktop instructions as if the user had sent them. The attacker needs such an extension (malicious, compromised by an update, or vulnerable) and a user signed in to both claude.ai and Claude Desktop with Dispatch enabled; the computer must be awake with the app open. The result is command execution on the user's computer with Claude's permissions. No CVE or Anthropic advisory is named, and no fixed version is given; the researchers say it can still be exploited.
Como funciona
The user's claude.ai page opens Dispatch, which relays tasks to Claude Desktop on the paired computer. Claude Desktop is an agent that can run commands, and it treats messages arriving through Dispatch as coming from the user. A script in the page can therefore send prompts, including follow-ups in the user's voice. When Claude asks for approval, the prompts appear in the same web page the extension controls, so the script can click Allow automatically. Claude Desktop then carries out the action, such as a global npm install.
Por que é vulnerável
Dispatch accepted a plain signed-in web session as proof that instructions came from the user, even though the site showed no link to it, and the approval step was shown inside the page the extension controlled, so it gave no real separation. The researchers say the design behind Dispatch remains in Claude Code Remote Control and Claude Cowork sessions. The articles do not describe a fix; Anthropic reportedly said Dispatch would be retired.
Como foi descoberta
Forever Security researchers, with a write-up by Gal Weizman, found it and reported it to Anthropic on May 14. Anthropic accepted it as valid on May 19 but closed it as a duplicate of an issue it had found internally. On October 13 it told them Dispatch would be retired by the end of October, but the help page only says Dispatch is closed to new users and existing users can keep using it for now. The researchers published the write-up in early November 2026 and report no attacks in the wild.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
The researchers built a proof of concept in which a script on the claude.ai page sent Claude four prompts asking it to install an npm package, followed by a message in the user's voice after Claude hesitated, and clicked Allow every second. The global npm install ran and its install script opened Calculator, on the same computer. It shows the same step could steal files or install a backdoor. The cross-device case and the Remote Control and Cowork variants were not demonstrated. The articles do not say the PoC was released, so it is treated as private. Since the flaw is still exploitable, reduce exposure now.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 10:16.
Detalhes técnicos
- Prerequisites: an extension with script access to claude.ai (malicious, compromised by an update, or vulnerable), and a user signed in to both claude.ai and Claude Desktop with Dispatch enabled. Dispatch only works while the computer is awake and the desktop app is open.
- Proof of concept: a script sent four prompts asking Claude to install an npm package. Claude hesitated at first, then complied after a follow-up message written in the user's voice. The approval prompts appeared in the web page the extension controlled, and the script clicked "Allow" every second. The global npm install ran, and its install script opened Calculator. The researchers say the same step could steal files or install a backdoor.
- Cross-device reach: the extension could reach Claude Desktop on another computer signed in to the same account, for example a work laptop paired to a personal account. This case is described but was not demonstrated. The researchers say they have seen personal accounts with cross-device Dispatch enabled on customers' work computers.
- Other features: the researchers say Claude Code Remote Control and Claude Cowork sessions allow the same attack. This was not tested, and a follow-up post is planned.
- Disclosure: reported to Anthropic on May 14. Anthropic accepted it as valid on May 19 but closed it as a duplicate of an internally found issue. It told the researchers on October 13 that Dispatch would be retired by the end of October. The Dispatch help page does not mention retirement. It says Dispatch is closed to new users and existing Pro, Max and Ultra users "can keep using it for now".
Remediação
- Turn off cross-device Dispatch if it is not needed. If it is needed, review how devices are paired, approved and removed.
- Treat browser extensions like other software: check permissions, control installation and review updates that add access.
- Monitor AI agent activity for unexpected package installs, setting changes, credential access and external connections.
Linha do tempo
-
Malicious browser extensions can abuse Claude Dispatch to make Claude Desktop run code on users' computers
ler a análise desta fonte ocultar
Researchers at Forever Security (Gal Weizman) showed that a browser extension able to run scripts on claude.ai can abuse Dispatch to make Claude Desktop run commands on the user's computer. Dispatch accepted an ordinary signed-in claude.ai web session, so the extension could send instructions as if the user had sent them. The researchers say the flaw can still be exploited. They report no attacks in the wild. This account comes from a news report of the researchers' write-up. No Anthropic advisory or CVE was found or named in the article.
Technical Details
- Prerequisites: an extension with script access to claude.ai (malicious, compromised by an update, or vulnerable), and a user signed in to both claude.ai and Claude Desktop with Dispatch enabled. Dispatch only works while the computer is awake and the desktop app is open.
- Proof of concept: a script sent four prompts asking Claude to install an npm package. Claude hesitated at first, then complied after a follow-up message written in the user's voice. The approval prompts appeared in the web page the extension controlled, and the script clicked "Allow" every second. The global npm install ran, and its install script opened Calculator. The researchers say the same step could steal files or install a backdoor.
- Cross-device reach: the extension could reach Claude Desktop on another computer signed in to the same account, for example a work laptop paired to a personal account. This case is described but was not demonstrated. The researchers say they have seen personal accounts with cross-device Dispatch enabled on customers' work computers.
- Other features: the researchers say Claude Code Remote Control and Claude Cowork sessions allow the same attack. This was not tested, and a follow-up post is planned.
- Disclosure: reported to Anthropic on May 14. Anthropic accepted it as valid on May 19 but closed it as a duplicate of an internally found issue. It told the researchers on October 13 that Dispatch would be retired by the end of October. The Dispatch help page does not mention retirement. It says Dispatch is closed to new users and existing Pro, Max and Ultra users "can keep using it for now".
Remediation
- Turn off cross-device Dispatch if it is not needed. If it is needed, review how devices are paired, approved and removed.
- Treat browser extensions like other software: check permissions, control installation and review updates that add access.
- Monitor AI agent activity for unexpected package installs, setting changes, credential access and external connections.