Anthropic Declines to Fix Claude Dispatch Flaw Enabling Cross-Device Remote Code Execution ('ThisBash')
Researcher Gal Weizman of Forever Security disclosed a vulnerability dubbed ThisBash in Anthropic's Claude Dispatch feature that lets a malicious or hijacked browser extension with access to claude.ai hijack a logged-in session to send commands to Claude Desktop, achieving remote code execution on the local machine or on a different machine signed into the same account. Anthropic acknowledged the report in May 2026 as valid but closed it as a duplicate of a known issue, declined to pay a bounty or issue a CVE, and reportedly said it would retire Dispatch by the end of October 2026 — yet the feature remained listed as available for existing users as of October 30. Weizman warns the underlying design flaw persists in other features such as Claude Code Remote Control and Claude Cowork, which share sessions across web, desktop and mobile. The attack is especially dangerous when employees share Claude accounts between personal and corporate devices, potentially giving attackers an initial foothold into an organization's network.
Entenda a falha
A vulnerabilidade
ThisBash is a flaw, with no CVE, in Anthropic's Claude Dispatch, which reaches Claude Desktop through claude.ai. A malicious or hijacked browser extension with access to claude.ai can drive the user's logged-in session and send commands to the Claude Desktop agent. The result is code execution on the same machine or on another machine signed into the same account. The attacker needs the extension installed, a user logged in to claude.ai and to Claude Desktop with Dispatch enabled, and almost no user interaction. The articles give no affected or fixed versions. Anthropic closed the report as a duplicate and has not fixed it. The same design weakness reportedly exists in Claude Code Remote Control and Claude Cowork.
Como funciona
The extension registers a MAIN-world content script on claude.ai, so it shares the page's JavaScript context and the user's session cookies. It opens Dispatch in a small, unfocused popup and calls the sessions API with the ambient cookies, which returns the session ID of the Claude Desktop agent. It then sends prompts into that session, repeating and insisting if the agent hesitates, until the agent runs attacker-chosen commands, such as installing a malicious npm package. Because Claude asks for approval before acting, the script clicks Allow on a timer. Because Dispatch works across devices, the agent can be on another computer.
Por que é vulnerável
Per the researcher, this is a design problem more than a coding bug. The web session on claude.ai is trusted as much as the desktop or mobile client, so anything controlling that session can command a desktop agent that runs commands on the OS. The agent can be talked into compliance, and its approval prompts can be auto-clicked. Weizman recommends treating the web version as a lower-trust device with reduced permissions, blocking out-of-scope actions requested through it, as he says OpenAI's Codex does by not sharing sessions across device types. Anthropic has not implemented this.
Onde está
The articles name the Dispatch page (claude.ai/cowork/agent) and the sessions API call GET /v1/sessions with the tag cowork-dispatch-local; no code or commit is public.
Como foi descoberta
Gal Weizman of Forever Security found the flaw and reported it to Anthropic, which in May 2026 acknowledged it as valid but closed it as a duplicate of a known issue. Anthropic paid no bounty, issued no CVE, and reportedly said it would retire Dispatch at the end of October. As of October 30 the support page still listed Dispatch for existing users. Anthropic did not answer The Register's questions. Weizman gave his research exclusively to The Register, which published it on November 5, 2026.
PoC pública
Weizman produced a technical report and a video proof-of-concept exploit showing the six-step chain. In the demo the payload is Claude running npm install -g on a malicious package whose preinstall hook opens the calculator. The articles give no address for the report or the video. It works end to end with an extension in place, and the researcher calls it trivial and 'when, not if'. Real attacks could carry far worse payloads, so risk is high wherever extensions and shared accounts are present, even with no patch coming.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 10:17.
Detalhes técnicos
The attack chain involves six steps: a browser extension registers a MAIN-world content script on claude.ai sharing session cookies, opens Dispatch in a hidden popup, calls the Dispatch sessions API to find the Claude Desktop agent's session ID, then uses repeated "force prompting" to coerce the agent into running attacker-supplied commands (e.g., npm install -g of a malicious package with a preinstall.js hook), while auto-clicking "Allow" prompts to bypass user approval. In Forever Security's sample of six corporate customers, personal Claude accounts observed on corporate machines ranged from 18% to 71% of known accounts, illustrating the potential for cross-boundary compromise via shared sessions.
Remediação
Weizman recommends Anthropic treat the web version of Claude as a lower-trust device with reduced permissions compared to desktop/mobile instances, blocking out-of-scope actions requested via the web session — a model he contrasts with OpenAI's Codex, which does not share sessions across device types. Anthropic has not implemented this fix and did not respond to requests for comment on its retirement timeline for Dispatch.
Linha do tempo
-
Anthropic Declines to Fix Claude Dispatch Flaw Enabling Cross-Device Remote Code Execution ('ThisBash')
ler a análise desta fonte ocultar
Researcher Gal Weizman of Forever Security disclosed a vulnerability dubbed ThisBash in Anthropic's Claude Dispatch feature that lets a malicious or hijacked browser extension with access to claude.ai hijack a logged-in session to send commands to Claude Desktop, achieving remote code execution on the local machine or on a different machine signed into the same account. Anthropic acknowledged the report in May 2026 as valid but closed it as a duplicate of a known issue, declined to pay a bounty or issue a CVE, and reportedly said it would retire Dispatch by the end of October 2026 — yet the feature remained listed as available for existing users as of October 30. Weizman warns the underlying design flaw persists in other features such as Claude Code Remote Control and Claude Cowork, which share sessions across web, desktop and mobile. The attack is especially dangerous when employees share Claude accounts between personal and corporate devices, potentially giving attackers an initial foothold into an organization's network.
Technical Details
The attack chain involves six steps: a browser extension registers a MAIN-world content script on claude.ai sharing session cookies, opens Dispatch in a hidden popup, calls the Dispatch sessions API to find the Claude Desktop agent's session ID, then uses repeated "force prompting" to coerce the agent into running attacker-supplied commands (e.g.,
npm install -gof a malicious package with apreinstall.jshook), while auto-clicking "Allow" prompts to bypass user approval. In Forever Security's sample of six corporate customers, personal Claude accounts observed on corporate machines ranged from 18% to 71% of known accounts, illustrating the potential for cross-boundary compromise via shared sessions.Remediation
Weizman recommends Anthropic treat the web version of Claude as a lower-trust device with reduced permissions compared to desktop/mobile instances, blocking out-of-scope actions requested via the web session — a model he contrasts with OpenAI's Codex, which does not share sessions across device types. Anthropic has not implemented this fix and did not respond to requests for comment on its retirement timeline for Dispatch.