Claude Dispatch flaw lets browser extensions run code on desktops, Forever Security says

What Forever Security found

Security firm Forever Security has published a write-up titled ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS, describing how a browser extension can turn a feature of Anthropic's Claude apps into a way to run commands on a user's computer. The feature is Dispatch, which passes tasks from Claude in the browser to the Claude Desktop app, where Claude can act on the local machine. The researchers named their technique ThisBash. Coverage by The Hacker News, Dataconomy and GBHackers followed in the first week of November 2026.

The attack does not rely on a browser exploit or a bug in the operating system. According to the researchers, it needs three things: a browser extension that is allowed to run scripts on claude.ai, a user who is signed in to both claude.ai and Claude Desktop with Dispatch turned on, and a computer that is awake with the desktop app open. The extension does not have to be written by an attacker. Forever Security notes that it could be malicious from the start, taken over through a bad update from its developer, or simply buggy, which matters because many popular extensions request permission to read and change every site a user visits.

In the proof of concept, a script injected by the extension opened Dispatch in a small popup window, read the session identifier of the user's Claude Desktop instance and then typed a series of four prompts as if the user had written them. Those prompts led Claude to install a package from the npm registry that the researchers had prepared. In their demonstration the package launched the calculator, a common way for security researchers to show that arbitrary code ran without causing harm. A real attacker could have used the same step to install anything that npm can deliver.

Forever Security also describes a cross-device angle. Because Dispatch links a Claude account to the desktop apps that are signed in to it, an extension running in the browser on one machine could target a different machine signed in to the same account. The researchers give the example of an extension on a personal laptop reaching a work laptop where the same person uses Claude Desktop. That is the scenario that coverage summarised as remote commands across corporate boundaries, since the device that runs the commands may sit inside a company network while the browser that starts the attack does not.

How Anthropic handled the report

According to the Forever Security post, the firm reported the issue to Anthropic on 14 May 2026. On 19 May 2026 Anthropic acknowledged that the findings were valid but closed the report as a duplicate of an issue it had already found internally. The researchers say Anthropic told them it would deal with the problem by retiring Dispatch, with a target of the end of October 2026, rather than by shipping a patch to the feature. They also say no CVE identifier was assigned and no bug bounty was paid. No on-the-record statement from Anthropic about the research appears in the coverage reviewed for this story.

Reports differ on how far that retirement has gone. One account says Dispatch was still available in a limited beta to some paying subscribers as of 30 October, while new users could no longer turn it on. Another says Anthropic's help pages now state that Dispatch is unavailable to new users but that existing users can keep using it. Both versions point the same way: the feature is closed to new sign-ups, but people who already had it may still be exposed until it is switched off for everyone. Anthropic has not published a final shutdown date in the material reviewed here.

What it means for users and what to watch

For people who still have Dispatch, the mitigation the researchers give is direct: turn Dispatch off, or sign out of Claude Desktop on machines that do not need it. Either step removes the path the attack uses. Reviewing browser extensions is the other half. An extension that can read and change data on all websites can also run scripts on claude.ai, so the risk sits with any extension that holds that broad permission, not only with ones that mention AI. Removing extensions that are no longer used, and limiting site access to the sites an extension actually needs, shrinks the set of code that can speak for the user inside a Claude session.

Several questions remain open. Anthropic has not said publicly when Dispatch will be switched off for existing users, or whether Claude Code Remote Control and Cowork sessions, which the researchers say share the same design issue, will get changes in response. It is also not stated whether the internal issue Anthropic cited as the original was the same attack path or a related one. If Anthropic publishes a security advisory or a changelog entry about Dispatch, this story will be updated. More detail on the company is on the Anthropic page, and the site's cybersecurity section tracks agent and prompt injection research as it appears.

Questions people ask

What is the Claude Dispatch ThisBash flaw?

It is a technique described by Forever Security in which a browser extension that can run scripts on claude.ai uses Dispatch to send prompts to Claude Desktop, which then runs commands on the user's computer.

Has Anthropic fixed it?

According to the researchers, Anthropic closed the May 2026 report as a duplicate and said it would retire Dispatch, targeting the end of October 2026, rather than patch it. No CVE was issued.

How can users protect themselves?

Forever Security says turning off Dispatch, or signing out of Claude Desktop on machines that do not need it, removes the attack path. Removing extensions with access to all websites also reduces the risk.

Sources

1. ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS (Forever Security, 4 Nov 2026)
2. Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers (The Hacker News, 5 Nov 2026)
3. Anthropic Leaves Claude Flaw Enabling Cross-device Code Execution Unfixed (Dataconomy, 6 Nov 2026)
4. Claude AI Flaw Lets Malicious Browser Extensions Execute Commands on Remote Computers (GBHackers, 5 Nov 2026)