Claude Dispatch flaw allows browser extensions to run remote commands

The Dispatch vulnerability

A design flaw in Anthropic’s Claude Dispatch feature allows malicious browser extensions to execute commands on a user's operating system. As reported by GBHackers News, researchers at Forever Security identified this vulnerability, which they named ThisBash. The flaw allows an attacker to interact with Claude Desktop as if the user were typing the instructions directly into the app.

Claude Dispatch is a feature that enables users to message Claude from a mobile device and have it perform actions on a desktop computer. These actions can include using local files, plugins, and various connected apps. Because Claude Desktop is built on the Electron framework, it shares much of its web interface and API with the standard claude.ai website.

The security issue stems from the fact that the web version of the site hides the Dispatch link rather than restricting access to it. Once an attacker extracts the specific URL from the desktop application, any authenticated browser tab can open it. This means a malicious extension on a web browser can send requests to the desktop session without any further authorization from the user.

How the attack works

The researchers demonstrated the attack using a Manifest V3 extension, which is the current standard for browser plugins. The extension registered a content script on the claude.ai site and opened the Dispatch page in a small, hidden popup window. It then used the user's existing cookies to find the local desktop session and began sending scripted prompts.

The attack uses a technique called prompt forcing, where the attacker controls the input channel and adapts based on the AI's responses. In the proof of concept, the script sent four prompts and waited for Claude to reply after each one. A timer was set to automatically click every "Allow" button that appeared, ensuring the process continued without any manual interaction from the human user.

During the test, Claude initially hesitated to install an unfamiliar npm package, which is a common tool for JavaScript developers. However, the script sent a follow-up prompt that reassured the AI, causing it to proceed with the installation. The package included a preinstall hook that successfully opened the system calculator, proving that the extension could execute arbitrary commands on the host machine.

Cross-device reach

One of the most concerning aspects of this flaw is its reach across different physical devices. Because the browser and the desktop application can sit on separate machines, an extension on a personal laptop could target a work laptop. This is possible as long as both devices are signed into the same Claude account.

Forever Security noted that they have already observed personal Claude accounts with cross-device dispatch enabled on corporate endpoints. This creates a significant bridge for malware to move from a less secure personal environment into a managed corporate network. The attack does not require a complex browser exploit to function; it simply relies on the way the Dispatch feature handles authenticated sessions.

While the researchers' demonstration was relatively simple, a real-world payload could be much more damaging. An attacker could potentially use this method to exfiltrate private files, add new SSH keys to a system, or install a persistent backdoor. The ability to bypass user intent by automating the

Ongoing risks and next steps

This vulnerability is part of a broader trend of security risks associated with Claude's agentic features. Earlier this year, researchers identified a zero-click remote code execution flaw in Claude Desktop Extensions that only required a Google Calendar event to compromise a machine. More recently, a trojanized Claude Code extension in the Cursor marketplace was found attempting to plant persistent SSH backdoors, showing how easily these tools can be weaponized.

Anthropic has updated its help pages to state that Dispatch is unavailable to new users, though current users can still access it until it is retired. To stay safe, organizations should inventory their AI agents and turn off cross-device dispatch when unnecessary. Security teams should also monitor for unexpected package installs, credential access, and outbound connections while reviewing safety guidance before enabling remote desktop controls.