Claude Dispatch flaw allows browser extensions to run local code

The Dispatch vulnerability

Security researchers from Forever Security have identified a significant flaw in Claude Dispatch. This feature is designed to let users send tasks from a mobile phone or web browser to Claude Desktop, which is an AI agent capable of interacting with local files and running terminal commands.

The researchers discovered that the interface and API for Dispatch were reachable from a standard signed-in session on the claude.ai website. Even though the website does not show a visible link to the Dispatch feature, the underlying system remains accessible to scripts.

Because of this design gap, a script injected by a browser extension can open a small popup to access the Dispatch tool. This allows the extension to grab a desktop session ID and send prompts to the AI agent without the user's direct interaction.

How the attack works

The attack relies on the fact that the AI agent runs with the user's permissions on the local computer. In a demonstration, a script typed four prompts into the AI's interface using the user's voice. The agent initially hesitated over an unfamiliar npm package, but a follow-up message from the script convinced it to proceed.

To ensure the process happened without human intervention, the script was designed to click every "Allow" button once a second. This automated behavior prevents the user from noticing the AI's request to execute a command. Once the script clicked the buttons, the package's installation script opened the Calculator app on the computer.

While the researchers only demonstrated opening the Calculator, they noted that the same method could be used for more malicious actions. An attacker could potentially use this path to steal private files or plant a backdoor on the machine. The flaw exists as long as the Dispatch feature remains active on the user's account.

Who is at risk

Several specific conditions must be met for this security flaw to be exploited. First, the user must have a browser extension installed that has the ability to run scripts on the claude.ai domain. This could be a malicious extension, a hijacked legitimate one, or a buggy tool.

Second, the user must be signed into both the claude.ai website and the Claude Desktop application. The computer must also be awake with the Claude Desktop app currently open. If these conditions are met and Dispatch is enabled, the extension can bridge the gap between the web and the local machine.

The researchers also pointed out that because Dispatch links different devices, an extension could potentially reach a Claude Desktop instance on a different computer. For example, a user signed into the same account on a work laptop might be vulnerable even if they are currently browsing on a personal device. However, the researchers noted this specific scenario was described but not demonstrated.

A design-level problem

The researchers describe this issue as a design gap rather than a simple software bug. The root problem is that the system treats a logged-in web session as sufficient proof that the user has approved a local command. This logic creates a bridge that allows web-based scripts to exert control over a local terminal or file system.

This same trust model also applies to other Anthropic features, specifically Claude Code Remote Control and Cowork sessions. Because these tools are designed to give AI agents keys to files and terminals, every extension that touches the chatbot's web page becomes part of the security boundary.

Anthropic has chosen to retire the Dispatch feature as a fix for this issue. However, the researchers argue that while retiring the feature stops this specific path, the wider trust model remains untouched. This means that as AI agents become more integrated into local systems, the security risks associated with web-based permissions will continue to grow.

Staying secure

Users who currently have access to Claude Dispatch can mitigate this risk by turning the feature off. Alternatively, signing out of Claude Desktop on any machines that do not strictly require the feature will remove the path for the attack. These steps are recommended for Pro, Max, and Ultra subscribers who still have access to the tool.

Beyond turning off specific features, the researchers suggest that users should audit their browser extensions. Any extension with permission to access claude.ai should be scrutinized, as the attack begins with the script's ability to interact with the web page. Keeping the number of active extensions to a minimum is a primary defense.

As reported by ShiftDelete.Net, this is the second major AI-agent security scare this week. The situation highlights a growing need for users to be cautious about the permissions they grant to third-party software. For now, the best practice is to limit the tools that can interact with your AI agents and your local operating system.