# Researcher Says a Claude Dispatch Flaw Lets Browser Extensions Run Code Through Claude Desktop, and Anthropic Has Not Fixed It

Times of AI Desk · 2026-11-05 · Security

[https://timesof.ai/2026/11/claude-dispatch-flaw-extensions-run-code-anthropic-unfixed](https://timesof.ai/2026/11/claude-dispatch-flaw-extensions-run-code-anthropic-unfixed)

> Forever Security researcher Gal Weizman told The Register that any browser extension able to control claude.ai could use Claude Dispatch to make Claude Desktop run code, including on another computer signed into the same account. He says Anthropic acknowledged the report in May, closed it as a duplicate and said it would retire Dispatch by the end of October; the feature was still listed as available on October 30. Anthropic did not respond to The Register.

The weak point a security researcher describes in Claude is not a bug in the model but a design choice about which devices trust each other. Gal Weizman of **Forever Security** says a browser extension that can control a logged-in claude.ai tab can send tasks through **Claude Dispatch** to **Claude Desktop**, the agent that runs commands on a user's computer, and get code executed there. He shared the research exclusively with **The Register**, which published it on **November 5**.

## What the researcher found

Dispatch lets users send tasks from a phone or browser to Claude Desktop. Weizman found that Dispatch's interface and API were reachable from an ordinary web session at claude.ai, so an extension with access to that page could issue instructions to the desktop agent as if it were the user, The Register reported. Claude Desktop asks for approval before acting; in his proof of concept, the extension approved those prompts automatically, according to the report.

Because Dispatch works across machines, Weizman says the same path can reach a different computer signed into the same Claude account. That matters most where employees use one account on personal and work machines. Forever Security told The Register that in six customer organizations, personal accounts made up between 18% and 71% of the Claude accounts it could see; at one, 255 of 1,233 accounts were personal.

The attack needs an extension with access to claude.ai, either a malicious one or a legitimate one that has been hijacked, and the user must be signed in to both claude.ai and Claude Desktop. Weizman said such extension takeovers "happen a lot."

## How Anthropic handled the report

Weizman says he reported the flaw, which he calls **ThisBash**, in **May**. According to The Register, Anthropic acknowledged it as valid, closed it as a duplicate of an issue it was already tracking, paid no bounty, issued no CVE, and told him it planned to retire Dispatch at the end of October. As of **October 30**, Anthropic's support page still listed Dispatch in limited beta on some paid plans, closed to new users. Anthropic did not respond to The Register's questions.

Weizman argues that retiring Dispatch would not end the problem, because the same cross-device design runs through **Claude Code Remote Control** and **Claude Cowork** sessions, which can be reached from the web. Forever Security's own summary says the design flaw "runs through other parts of the Claude suite." He told The Register that OpenAI's Codex does not let a web session reach sessions started on the desktop. Anthropic recently [merged chat and Cowork](https://timesof.ai/2026/10/anthropic-unified-claude-chat-cowork-enterprise) for enterprise users, which widens where those sessions appear.

## Limits

- The findings and the customer account figures come from Forever Security, a vendor that sells security tooling, and have not been independently reproduced in public.
- Anthropic has not commented, so its view of severity, and whether the duplicate it cited has been fixed elsewhere, is unknown.
- The Remote Control and Cowork claims are the researcher's; The Register does not describe separate proof-of-concept work for them.
- We read Forever Security's blog summary, not its full technical write-up, and do not reproduce exploit steps.

## Sources

- [The Register: Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries (November 5, 2026)](https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684)
- [Forever Security: Research blog, "ThisBash Escape" (November 5, 2026)](https://forever.security/blog/)