ThisBash: unfixed Claude Dispatch flaw lets malicious browser extensions run commands on Claude Desktop, including on other machines
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 06/11/2026 12:07; os links antigos trazem para cá.
Fontes: thehackernews.com ↗ gbhackers.com ↗ theregister.com ↗
Researcher Gal Weizman of Forever Security disclosed ThisBash, a design flaw in Anthropic's Claude Dispatch. A browser extension that can run scripts on claude.ai can use the user's signed-in session to send commands to Claude Desktop as if the user had typed them. The result is code execution on the local machine, or on another machine signed in to the same Claude account. Forever Security reported it on 14 May 2026. Anthropic accepted it as valid on 19 May but closed it as a duplicate of an internally found issue, with no CVE, no bounty and no fix (theregister.com, thehackernews.com). Anthropic told the researchers on 13 October that Dispatch would be retired by the end of October. As of 6 November the help page still lets existing users keep using it, so the flaw is reported as still exploitable (thehackernews.com). No attacks in the wild have been reported (thehackernews.com).
Entenda a falha
A vulnerabilidade
ThisBash is a design flaw in Anthropic's Claude Dispatch, the feature that sends tasks from a phone or browser to Claude Desktop. Dispatch accepted an ordinary signed-in claude.ai web session, so a browser extension that can run scripts on claude.ai can send Claude Desktop commands as if the user had typed them. The attacker needs such an extension (malicious, compromised by an update, or vulnerable) and a user signed in to both claude.ai and Claude Desktop with Dispatch enabled, with the computer awake and the app open. The result is code execution on that computer, or on another one signed in to the same account. There is no CVE, no advisory, no fixed version, and the flaw is reported as still exploitable.
Como funciona
The user's claude.ai page can reach Dispatch, which relays tasks to the Claude Desktop agent on a paired computer. That agent can run commands and treats Dispatch messages as coming from the user. A script in the page finds the desktop agent's session using the user's cookies, then sends a series of prompts, reads Claude's replies and adapts. When Claude hesitates, follow-up messages in the user's voice push it to proceed. Claude's approval prompts render in the same page the extension controls, so the script clicks Allow automatically, and the agent then performs the action, such as a global npm install.
Por que é vulnerável
Dispatch treated an authenticated web session as proof that the user authorized a command on their machine. Its web link was hidden on claude.ai but not access-restricted, so once the URL was taken from the desktop app any authenticated tab could use it. The approval step also ran inside the page the extension controlled, so it gave no real separation. The researchers say the underlying design persists in Claude Code Remote Control and Claude Cowork sessions, which they claim allow the same attack (not tested). Weizman suggests treating the web client as a lower-privilege device that cannot run commands. No fix exists.
Onde está
The articles name the Dispatch page at claude.ai/cowork/agent and the sessions endpoint GET /v1/sessions with the tag cowork-dispatch-local, but no public code or commit.
Como foi descoberta
Gal Weizman of Forever Security found it and reported it to Anthropic on 14 May 2026. Anthropic accepted it as valid on 19 May but closed it as a duplicate of an issue it had found internally, with no CVE or bounty. On 13 October it told the researchers Dispatch would be retired by the end of October, but as of early November the help page still lets existing users keep using it. The research was published in early November, shared first with The Register, and no attacks in the wild are reported.
PoC pública
Forever Security published a technical write-up and a video proof of concept. A script on the claude.ai page sent four prompts asking Claude Desktop to install an npm package, followed by a message in the user's voice after Claude hesitated, and clicked Allow every second. The global npm install ran and the package's install script opened Calculator, on the same computer. It shows the same step could steal files or install a backdoor. The cross-device case and the Remote Control and Cowork variants were described but not demonstrated. The flaw is unpatched, so reduce exposure now.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 12:23.
Detalhes técnicos
- Prerequisites: an extension with script access to claude.ai (malicious, compromised via an update, or vulnerable) and a user signed in to both claude.ai and Claude Desktop with Dispatch enabled (theregister.com, thehackernews.com). Dispatch works only while the computer is awake and the desktop app is open (thehackernews.com). Cowork and Code remote-session discovery reduce the need for Dispatch to be enabled (theregister.com).
- Root cause: Dispatch's web link was hidden on claude.ai but not access-restricted. Once the URL was extracted from the desktop app, any authenticated tab could open it and send requests (gbhackers.com). The researchers argue an authenticated web session is not proof that the user authorized a command on their machine (gbhackers.com).
- Attack chain:
- A Manifest V3 extension registers a MAIN-world content script on claude.ai, sharing the page's JavaScript context and session cookies (theregister.com, gbhackers.com).
- The script opens the Cowork agent page in a tiny (200x200), unfocused popup (theregister.com, gbhackers.com).
- It calls
GET /v1/sessions?tags=cowork-dispatch-localwith the ambient cookies to get the desktop agent's session ID (theregister.com). - It sends four scripted prompts, waiting for Claude's reply after each. Claude hesitated to install an unfamiliar npm package, then complied after a follow-up written in the user's voice (gbhackers.com, thehackernews.com). The researchers call this "prompt forcing": the attacker controls the input channel, reads responses and adapts.
- A one-second timer clicks every "Allow" button on approval prompts, which render in the page the extension controls (theregister.com, gbhackers.com, thehackernews.com).
- The proof of concept ran a global
npm install -gof a malicious package whose preinstall hook opened Calculator. The researchers say a real payload could exfiltrate files, add SSH keys or install a backdoor.
- Cross-device reach: a personal Claude account in a browser can reach Claude Desktop on a work laptop signed in to the same account. This was described but not demonstrated (thehackernews.com). Forever Security found personal Claude accounts on corporate endpoints at 18% to 71% across six customer organizations (theregister.com).
- Other features: the researchers say Claude Code Remote Control and Claude Cowork sessions allow the same attack. This was not tested, and a follow-up post is planned (thehackernews.com, gbhackers.com).
- Context: gbhackers.com cites a LayerX 2025 report that 99% of enterprise users have at least one browser extension and 53% have extensions with high or critical permissions.
- Suggested fix (Weizman): treat the web client as a separate, lower-privilege device and block out-of-scope actions such as running commands. He contrasts this with OpenAI Codex, which does not share sessions across web and desktop (theregister.com).
Remediação
No patch or Anthropic advisory exists. Dispatch is closed to new users, and existing Pro, Max and Ultra users "can keep using it for now" (thehackernews.com). Defender guidance from the sources:
- Turn off cross-device Dispatch where it is not needed. Otherwise, review how devices are paired, approved and removed (thehackernews.com, gbhackers.com).
- Inventory the AI agents and Claude accounts in use, and keep personal and work Claude accounts separate (gbhackers.com).
- Govern browser extensions like endpoint software: check permissions, control installation and review updates that add access (thehackernews.com, gbhackers.com).
- Monitor AI agent activity for unexpected package installs, setting changes, credential access and external connections (thehackernews.com).
Relatos divergentes
- Report status: theregister.com (earliest) says Anthropic closed the report as a duplicate. gbhackers.com says Anthropic acknowledged it as valid. thehackernews.com, the most detailed on disclosure, reconciles the two: accepted as valid on 19 May, then closed as a duplicate of an internal issue.
- Dispatch retirement: theregister.com says retirement was planned for the end of October, yet the support page still listed Dispatch in limited beta as of 30 October. gbhackers.com says the flaw stays exploitable until retirement. thehackernews.com, the most recent source, says the help page does not mention retirement and that existing users can keep using it for now. The October target therefore does not appear to have been met, and retirement remains unconfirmed.
- Scope of testing: theregister.com and gbhackers.com state that Claude Code Remote Control and Cowork share the weakness. thehackernews.com notes this was not tested, so treat it as the researchers' claim.
Linha do tempo
-
Malicious browser extensions can abuse Claude Dispatch to make Claude Desktop run code on users' computers
ler a análise desta fonte ocultar
Researchers at Forever Security (Gal Weizman) showed that a browser extension able to run scripts on claude.ai can abuse Dispatch to make Claude Desktop run commands on the user's computer. Dispatch accepted an ordinary signed-in claude.ai web session, so the extension could send instructions as if the user had sent them. The researchers say the flaw can still be exploited. They report no attacks in the wild. This account comes from a news report of the researchers' write-up. No Anthropic advisory or CVE was found or named in the article.
Technical Details
- Prerequisites: an extension with script access to claude.ai (malicious, compromised by an update, or vulnerable), and a user signed in to both claude.ai and Claude Desktop with Dispatch enabled. Dispatch only works while the computer is awake and the desktop app is open.
- Proof of concept: a script sent four prompts asking Claude to install an npm package. Claude hesitated at first, then complied after a follow-up message written in the user's voice. The approval prompts appeared in the web page the extension controlled, and the script clicked "Allow" every second. The global npm install ran, and its install script opened Calculator. The researchers say the same step could steal files or install a backdoor.
- Cross-device reach: the extension could reach Claude Desktop on another computer signed in to the same account, for example a work laptop paired to a personal account. This case is described but was not demonstrated. The researchers say they have seen personal accounts with cross-device Dispatch enabled on customers' work computers.
- Other features: the researchers say Claude Code Remote Control and Claude Cowork sessions allow the same attack. This was not tested, and a follow-up post is planned.
- Disclosure: reported to Anthropic on May 14. Anthropic accepted it as valid on May 19 but closed it as a duplicate of an internally found issue. It told the researchers on October 13 that Dispatch would be retired by the end of October. The Dispatch help page does not mention retirement. It says Dispatch is closed to new users and existing Pro, Max and Ultra users "can keep using it for now".
Remediation
- Turn off cross-device Dispatch if it is not needed. If it is needed, review how devices are paired, approved and removed.
- Treat browser extensions like other software: check permissions, control installation and review updates that add access.
- Monitor AI agent activity for unexpected package installs, setting changes, credential access and external connections.
-
ThisBash: Claude Dispatch design flaw lets malicious browser extensions run commands on Claude Desktop, including on other machines
gbhackers.com reports that Anthropic acknowledged the report as valid, which differs from the earlier account that it was closed as a duplicate. It also says Dispatch is unavailable to new users and that the flaw stays exploitable until retirement. The article adds LayerX extension statistics and defender guidance.
ler a análise desta fonte ocultar
gbhackers.com reports that Anthropic acknowledged the report as valid, which differs from the earlier account that it was closed as a duplicate. It also says Dispatch is unavailable to new users and that the flaw stays exploitable until retirement. The article adds LayerX extension statistics and defender guidance.
Researchers at Forever Security disclosed ThisBash, a design flaw in Anthropic's Claude Dispatch. Dispatch accepted instructions from an ordinary logged-in claude.ai session. A browser extension that controls that site could therefore send commands to Claude Desktop as if the user had typed them. The browser and the desktop can be on different machines, so a personal laptop could reach a work laptop signed into the same Claude account. Forever Security reported the issue on May 14, 2026, and Anthropic acknowledged it as valid. Anthropic says Dispatch will be retired, targeting the end of October 2026, and the flaw stays exploitable until then. No CVE is mentioned.
Technical Details
- Dispatch's web link was hidden on claude.ai but not access-restricted. Once the URL was extracted from the desktop app, any authenticated browser tab could open it and send requests (gbhackers.com).
- The proof of concept used a Manifest V3 extension with a content script on claude.ai. It opened the Dispatch page in a 200x200 unfocused popup and called the sessions endpoint with the user's cookies to find the local desktop session (gbhackers.com).
- The script sent four scripted prompts and waited for Claude's reply after each. A one-second timer clicked every "Allow" button that appeared (gbhackers.com).
- Claude first hesitated to install an unfamiliar npm package. A follow-up prompt reassured it and the install went ahead. The package's preinstall hook opened Calculator (gbhackers.com).
- The researchers call this "prompt forcing": the attacker controls the input channel, reads Claude's responses and adapts. They say a real payload could exfiltrate files, add SSH keys or install a backdoor (gbhackers.com).
- They say Claude Code Remote Control and Claude Cowork sessions allow the same attack. They argue the root cause is that an authenticated web session is not proof that the user authorized a command on their machine (gbhackers.com).
- Forever Security says it has seen personal Claude accounts with cross-device dispatch enabled on corporate endpoints. The article cites a LayerX 2025 report: 99% of enterprise users have at least one extension, and 53% have extensions with high or critical permissions (gbhackers.com).
Remediation
The article names no patch. Dispatch is unavailable to new users, and existing users can keep using it until retirement. Its advice:
- Inventory the AI agents and Claude accounts in use.
- Turn off cross-device dispatch where it is not needed.
- Keep personal and work Claude accounts separate.
- Govern browser extensions like endpoint software, with controlled installation and permission reviews.
- Monitor agent processes for unexpected package installs, credential access and outbound connections.
-
ThisBash: Unfixed Claude Dispatch flaw lets malicious browser extensions run code on Claude Desktop, including on other machines
ler a análise desta fonte ocultar
Forever Security researcher Gal Weizman disclosed ThisBash, a design flaw in Anthropic's Claude Dispatch. Any browser extension that can control a logged-in claude.ai session can send commands to Claude Desktop as if they came from the legitimate user. That gives code execution on the local machine, or on another machine signed into the same Claude account. Anthropic accepted the report in May 2026 but closed it as a duplicate of a known issue. It issued no CVE and paid no bounty, and it has taken no fix action, according to The Register. Anthropic reportedly planned to retire Dispatch at the end of October, but as of 30 October the support page still listed it in limited beta for existing users. Weizman says the same weakness persists in Claude Code Remote Control and Claude Cowork sessions.
Technical Details
- Prerequisites: a malicious or hijacked browser extension with access to claude.ai. The user must be signed in to both claude.ai and Claude Desktop. Dispatch must be enabled, although Cowork and Code remote-session discovery reduce the need for that (theregister.com).
- Attack chain (theregister.com):
- The extension registers a MAIN-world content script on claude.ai, which shares the page's JavaScript context and the user's session cookies.
- The script opens https://claude.ai/cowork/agent in a tiny, unfocused popup.
- It calls GET /v1/sessions?tags=cowork-dispatch-local with the ambient cookies and gets the session ID of the desktop agent.
- It "force prompts" the agent, rephrasing and insisting until the agent complies.
- A one-second interval auto-clicks "Allow" on approval prompts.
- It repeats until RCE. The proof of concept ran
npm install -gon a malicious package whose preinstall.js hook opened the calculator.
- Cross-machine impact: Dispatch works across devices, so a personal Claude account in a browser can reach Claude Desktop on a work laptop. Forever Security found personal Claude accounts in corporate environments at 18% to 71% across six customer organizations (theregister.com).
- Weizman's suggested fix is to treat the web client as a separate, lower-privilege device and block out-of-scope actions such as running commands. He contrasts this with OpenAI Codex, which does not share sessions across web and desktop (theregister.com).
- Other outlets report that the report was filed on 14 May 2026 and that Anthropic announced the Dispatch retirement on 13 October (search summaries of cryptika.com, gbhackers.com and others; not opened).
Remediation
Anthropic has published no fix, and no vendor advisory was found. The only remediation in the sources is Weizman's suggestion that Anthropic treat the web client as a lower-privilege device. As general defender advice (the analyst's own, not from the sources), audit and restrict browser extensions that have access to claude.ai, and keep personal and corporate Claude accounts separate.