ThisBash: Claude Dispatch design flaw lets malicious browser extensions run code on Claude Desktop, including on other machines
Forever Security researcher Gal Weizman disclosed ThisBash, a design flaw in Anthropic's Claude Dispatch. Any browser extension that can control a logged-in claude.ai session can send commands to Claude Desktop as if they came from the legitimate user. That gives code execution on the local machine, or on another machine signed into the same Claude account. The report was filed on 14 May 2026. gbhackers.com says Anthropic acknowledged it as valid. The Register says Anthropic closed it as a duplicate of a known issue, issued no CVE, paid no bounty and took no fix action. gbhackers.com (6 November 2026) says Anthropic states Dispatch will be retired, targeting the end of October 2026, and that the flaw remains exploitable until the retirement. As of 30 October the support page still listed Dispatch in limited beta for existing users (theregister.com). A later help-page note says it is unavailable to new users, while existing users can keep using it (gbhackers.com). As of the gbhackers.com article date, 6 November 2026, no source in this case confirms that the retirement has taken place. Weizman says the same weakness persists in Claude Code Remote Control and Claude Cowork sessions.
Entenda a falha
A vulnerabilidade
ThisBash has no CVE. It is a design flaw in Anthropic's Claude Dispatch, which lets claude.ai drive the Claude Desktop agent. A malicious or hijacked browser extension with access to claude.ai can use the logged-in session to send commands to Claude Desktop as if the user had typed them. The result is code execution on the same machine or on another machine signed into the same Claude account. The attacker needs the extension installed and a user signed in to claude.ai and Claude Desktop with Dispatch enabled, and almost no user interaction. The articles give no affected or fixed versions and no fix exists. Weizman says the same weakness persists in Claude Code Remote Control and Claude Cowork sessions.
Como funciona
The extension registers a MAIN-world content script on claude.ai, so it shares the page's JavaScript context and the user's session cookies. It opens the Dispatch page in a tiny, unfocused popup and calls the sessions API with the user's cookies, which returns the session ID of the Claude Desktop agent. It then sends prompts into that session, rephrasing and insisting when the agent hesitates, until the agent runs attacker-chosen actions such as installing a malicious npm package. Because Claude asks for approval before acting, the script clicks Allow on a one-second timer. Since Dispatch works across devices, the target agent can be on another computer.
Por que é vulnerável
The researcher describes this as a design problem more than a coding bug: an authenticated web session is treated as proof that the user authorized a command on their machine. So anything controlling that session can drive a desktop agent that runs commands on the OS. According to gbhackers, the web version only hid the Dispatch link without restricting access, so once the URL was extracted from the desktop app any authenticated tab could use it. The agent can also be talked into compliance, and its approval prompts can be auto-clicked. Weizman suggests treating the web client as a lower-privilege device and blocking out-of-scope actions such as running commands; Anthropic has not done this.
Onde está
The articles name the Dispatch page (claude.ai/cowork/agent) and the sessions API call GET /v1/sessions with the tag cowork-dispatch-local; no code or commit is public.
Como foi descoberta
Gal Weizman of Forever Security found the flaw. Forever Security reported it to Anthropic on 14 May 2026. The Register says Anthropic acknowledged it as valid but closed it as a duplicate of a known issue, with no bounty, no CVE and no fix action; gbhackers only says it was acknowledged as valid. Anthropic reportedly said it would retire Dispatch at the end of October 2026, but as of 30 October the support page still listed it for existing users, and Anthropic did not answer The Register's questions. Weizman gave the research exclusively to The Register, which published it on 5 November, and gbhackers followed on 6 November.
PoC pública
Weizman produced a technical report and a video proof-of-concept exploit showing the full chain end to end. It used a Manifest V3 extension, a 200x200 popup and four scripted prompts. Claude hesitated at first, then a reassuring follow-up made it install an npm package whose preinstall hook opened Calculator. The articles give no address for the report or video. Once an extension is in place the researcher calls it trivial, and real payloads could steal files or add backdoors. Urgency is high where extensions and shared personal/work accounts exist, since no patch is coming.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 09:52.
Detalhes técnicos
- Prerequisites: a malicious or hijacked browser extension with access to claude.ai. The user must be signed in to both claude.ai and Claude Desktop. Dispatch must be enabled, although Cowork and Code remote-session discovery reduce the need for that (theregister.com).
- Root cause: the web Dispatch link was hidden but not access-restricted. Once the URL was extracted from the desktop app, any authenticated browser tab could open it (gbhackers.com).
- Attack chain (theregister.com):
- The extension registers a MAIN-world content script on claude.ai, which shares the page's JavaScript context and the user's session cookies.
- The script opens https://claude.ai/cowork/agent in a tiny, unfocused popup (200x200 per gbhackers.com).
- It calls GET /v1/sessions?tags=cowork-dispatch-local with the ambient cookies and gets the session ID of the desktop agent.
- It "force prompts" the agent, rephrasing and insisting until the agent complies. gbhackers.com describes four scripted prompts, with Claude initially hesitating over an unfamiliar npm package and then proceeding after a reassuring follow-up.
- A one-second interval auto-clicks "Allow" on approval prompts.
- It repeats until RCE. The proof of concept ran
npm install -gon a malicious package whose preinstall.js hook opened the calculator.
- Impact: the researchers say a real payload could exfiltrate files, add SSH keys or install a backdoor (gbhackers.com).
- Cross-machine impact: Dispatch works across devices, so a personal Claude account in a browser can reach Claude Desktop on a work laptop. Forever Security found personal Claude accounts in corporate environments at 18% to 71% across six customer organizations (theregister.com). It has also seen personal accounts with cross-device dispatch enabled on corporate endpoints. The article cites a LayerX 2025 report: 99% of enterprise users have at least one extension, and 53% have extensions with high or critical permissions (gbhackers.com).
- Weizman's suggested fix is to treat the web client as a separate, lower-privilege device and block out-of-scope actions such as running commands. He contrasts this with OpenAI Codex, which does not share sessions across web and desktop (theregister.com). The researchers argue an authenticated web session is not proof of user authorization of a local command, and plan a follow-up post (gbhackers.com).
- Other outlets report that Anthropic announced the Dispatch retirement on 13 October (search summaries of cryptika.com and others; not opened).
Remediação
Anthropic has published no fix, and no vendor advisory was found. The only planned remediation is retiring Dispatch. Defender advice from gbhackers.com:
- Inventory the AI agents and Claude accounts in use.
- Turn off cross-device dispatch where it is not needed.
- Keep personal and work Claude accounts separate.
- Govern browser extensions like endpoint software, with controlled installation and permission reviews.
- Monitor agent processes for unexpected package installs, credential access and outbound connections.
- Review Anthropic's guidance on using Cowork safely before enabling remote control of desktop agents.
Relatos divergentes
- Report handling: The Register says Anthropic closed the report as a duplicate, with no CVE, no bounty and no fix action. gbhackers.com says Anthropic acknowledged it as valid.
- Retirement status: gbhackers.com says Dispatch is targeted for retirement at the end of October 2026 and is unavailable to new users. The Register noted on 30 October that the support page still listed it in limited beta for existing users. The sources do not confirm that the retirement has happened.
Linha do tempo
-
ThisBash: Claude Dispatch design flaw lets malicious browser extensions run commands on Claude Desktop, including on other machines
gbhackers.com reports that Anthropic acknowledged the report as valid, which differs from the earlier account that it was closed as a duplicate. It also says Dispatch is unavailable to new users and that the flaw stays exploitable until retirement. The article adds LayerX extension statistics and defender guidance.
ler a análise desta fonte ocultar
gbhackers.com reports that Anthropic acknowledged the report as valid, which differs from the earlier account that it was closed as a duplicate. It also says Dispatch is unavailable to new users and that the flaw stays exploitable until retirement. The article adds LayerX extension statistics and defender guidance.
Researchers at Forever Security disclosed ThisBash, a design flaw in Anthropic's Claude Dispatch. Dispatch accepted instructions from an ordinary logged-in claude.ai session. A browser extension that controls that site could therefore send commands to Claude Desktop as if the user had typed them. The browser and the desktop can be on different machines, so a personal laptop could reach a work laptop signed into the same Claude account. Forever Security reported the issue on May 14, 2026, and Anthropic acknowledged it as valid. Anthropic says Dispatch will be retired, targeting the end of October 2026, and the flaw stays exploitable until then. No CVE is mentioned.
Technical Details
- Dispatch's web link was hidden on claude.ai but not access-restricted. Once the URL was extracted from the desktop app, any authenticated browser tab could open it and send requests (gbhackers.com).
- The proof of concept used a Manifest V3 extension with a content script on claude.ai. It opened the Dispatch page in a 200x200 unfocused popup and called the sessions endpoint with the user's cookies to find the local desktop session (gbhackers.com).
- The script sent four scripted prompts and waited for Claude's reply after each. A one-second timer clicked every "Allow" button that appeared (gbhackers.com).
- Claude first hesitated to install an unfamiliar npm package. A follow-up prompt reassured it and the install went ahead. The package's preinstall hook opened Calculator (gbhackers.com).
- The researchers call this "prompt forcing": the attacker controls the input channel, reads Claude's responses and adapts. They say a real payload could exfiltrate files, add SSH keys or install a backdoor (gbhackers.com).
- They say Claude Code Remote Control and Claude Cowork sessions allow the same attack. They argue the root cause is that an authenticated web session is not proof that the user authorized a command on their machine (gbhackers.com).
- Forever Security says it has seen personal Claude accounts with cross-device dispatch enabled on corporate endpoints. The article cites a LayerX 2025 report: 99% of enterprise users have at least one extension, and 53% have extensions with high or critical permissions (gbhackers.com).
Remediation
The article names no patch. Dispatch is unavailable to new users, and existing users can keep using it until retirement. Its advice:
- Inventory the AI agents and Claude accounts in use.
- Turn off cross-device dispatch where it is not needed.
- Keep personal and work Claude accounts separate.
- Govern browser extensions like endpoint software, with controlled installation and permission reviews.
- Monitor agent processes for unexpected package installs, credential access and outbound connections.
-
ThisBash: Unfixed Claude Dispatch flaw lets malicious browser extensions run code on Claude Desktop, including on other machines
ler a análise desta fonte ocultar
Forever Security researcher Gal Weizman disclosed ThisBash, a design flaw in Anthropic's Claude Dispatch. Any browser extension that can control a logged-in claude.ai session can send commands to Claude Desktop as if they came from the legitimate user. That gives code execution on the local machine, or on another machine signed into the same Claude account. Anthropic accepted the report in May 2026 but closed it as a duplicate of a known issue. It issued no CVE and paid no bounty, and it has taken no fix action, according to The Register. Anthropic reportedly planned to retire Dispatch at the end of October, but as of 30 October the support page still listed it in limited beta for existing users. Weizman says the same weakness persists in Claude Code Remote Control and Claude Cowork sessions.
Technical Details
- Prerequisites: a malicious or hijacked browser extension with access to claude.ai. The user must be signed in to both claude.ai and Claude Desktop. Dispatch must be enabled, although Cowork and Code remote-session discovery reduce the need for that (theregister.com).
- Attack chain (theregister.com):
- The extension registers a MAIN-world content script on claude.ai, which shares the page's JavaScript context and the user's session cookies.
- The script opens https://claude.ai/cowork/agent in a tiny, unfocused popup.
- It calls GET /v1/sessions?tags=cowork-dispatch-local with the ambient cookies and gets the session ID of the desktop agent.
- It "force prompts" the agent, rephrasing and insisting until the agent complies.
- A one-second interval auto-clicks "Allow" on approval prompts.
- It repeats until RCE. The proof of concept ran
npm install -gon a malicious package whose preinstall.js hook opened the calculator.
- Cross-machine impact: Dispatch works across devices, so a personal Claude account in a browser can reach Claude Desktop on a work laptop. Forever Security found personal Claude accounts in corporate environments at 18% to 71% across six customer organizations (theregister.com).
- Weizman's suggested fix is to treat the web client as a separate, lower-privilege device and block out-of-scope actions such as running commands. He contrasts this with OpenAI Codex, which does not share sessions across web and desktop (theregister.com).
- Other outlets report that the report was filed on 14 May 2026 and that Anthropic announced the Dispatch retirement on 13 October (search summaries of cryptika.com, gbhackers.com and others; not opened).
Remediation
Anthropic has published no fix, and no vendor advisory was found. The only remediation in the sources is Weizman's suggestion that Anthropic treat the web client as a lower-privilege device. As general defender advice (the analyst's own, not from the sources), audit and restrict browser extensions that have access to claude.ai, and keep personal and corporate Claude accounts separate.