A malicious or hijacked browser extension could use Claude Dispatch, Anthropic's feature for sending tasks from a phone or browser to its Claude Desktop agent, to make that agent run code on a user's computer, a security researcher told The Register in an exclusive report Thursday. Anthropic accepted the report but has not fixed it, the outlet said, which leaves companies to manage the risk through their own policies on AI agents.
What Happened
Gal Weizman of Forever Security, who named the issue "ThisBash," found that Dispatch could be driven from an ordinary logged-in session on the claude.ai website. Any extension able to script that site could open Dispatch in a tiny popup the user would barely notice, use the session's cookies to find the user's desktop agent, and send it instructions as if they came from the user.
In his proof of concept, the script repeatedly asked the agent to install a malicious software package and clicked "Allow" on each approval prompt every second until the code ran. The attack requires a bad or compromised extension with access to claude.ai, and a user signed in to both the website and Claude Desktop with Dispatch turned on.
Because Dispatch works across devices, a compromised browser on one computer could reach the agent on another, including a work laptop signed in to the same personal account. Weizman told The Register that Claude Cowork and Claude Code's remote-control feature share the same design weakness.
Anthropic acknowledged the report as valid in May, then closed it as a duplicate of a known issue, with no bounty and no CVE, the public identifier given to vulnerabilities. It told Weizman it planned to retire Dispatch at the end of October. As of Oct. 30, its help page still listed Dispatch in limited beta for some Pro, Max and Ultra plans, closed to new users, The Register reported. Anthropic did not answer the outlet's questions.
Why It Matters
AI agents that can run commands turn an old problem, risky browser extensions, into a path to code execution on company machines. Personal accounts widen the gap: in data the researcher's firm gathered from six client organizations, personal accounts made up 18% to 71% of the Claude accounts it could see; in one, 255 of 1,233 were personal.
Weizman suggested treating the web client as a separate, less trusted device, and said OpenAI's Codex does not share sessions between its web and desktop versions. The Primary Wire has reported an earlier, since-fixed flaw in Claude Code's desktop app and a tampered Claude Code extension in a third-party marketplace.
What to Watch
Whether Anthropic retires Dispatch and changes how web sessions control desktop agents in Cowork and Claude Code. Security teams can act now by limiting browser extensions, setting rules on personal AI accounts on work devices and switching off agent remote features they do not need.
