Researchers at Forever Security, an endpoint security company, showed that a browser extension able to run scripts on claude.ai can make Claude Desktop run code on a person’s computer. The route is Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop, an AI agent that can run commands on the machine where it is installed. The researchers found that Dispatch also accepted an ordinary signed-in session on claude.ai, even though the site showed no link to it, so an extension on the page could send instructions as if the user had sent them. They say the flaw can still be exploited and report no real-world attacks. The test was run with the browser and Claude Desktop on the same computer; reaching a different computer signed in to the same Claude account is described but was not demonstrated.
In the test, a script on the user’s claude.ai page opened Dispatch and sent four prompts asking Claude to install an npm package. Claude hesitated at the unfamiliar package, but a follow-up message in the user’s voice got it to continue. The approval prompts appeared in the web page the extension controlled, and the script clicked any “Allow” button every second. Claude ran a global npm install, and the package’s install script opened the Calculator app. The researchers say the same step could have stolen files or installed a backdoor, given Claude’s permissions. The extension could be malicious, a legitimate one with a compromised update, or one with its own flaw. Dispatch only works while the computer is awake and the desktop app is open.
Forever Security says it reported the flaw to Anthropic on May 14; Anthropic accepted it as valid on May 19 but closed it as a duplicate of an issue it had found internally. On October 13, the researchers say, Anthropic told them Dispatch would be retired, targeting the end of October. The Hacker News notes that the Dispatch help page, updated late last week, does not mention a retirement and says Dispatch is closed to new users while existing users on some Pro, Max and Ultra plans “can keep using it for now.” The researchers argue that Anthropic is “retiring Dispatch, but not the design behind it,” and say Claude Code Remote Control and Claude Cowork sessions would let extensions carry out the same attack. Their write-up does not test those features, and they plan a follow-up. An earlier agent-sandbox issue is covered in Claude Cowork Flaw Let AI Agents Escape to Your Mac’s Files.
How to check if you’re affected
Affected products per the researchers are Claude Desktop installs where Dispatch is turned on and the user is signed in to claude.ai in a browser that has an extension able to run scripts on that site. The Hacker News says that in Claude Desktop, Dispatch is part of Cowork and appears in the left-side panel. The researchers say they have seen personal Claude accounts with cross-device Dispatch turned on, on work computers at their customers, so one personal account used on both a home and a work machine widens the reach.
The researchers recommend these steps:
- Turn off cross-device Dispatch if you do not need it; if you do, review how devices are paired, approved and removed.
- Treat browser extensions like other software: check their permissions, control what gets installed, and review updates that give them more access.
- Monitor what AI agents do on the computer, including unexpected package installations, setting changes, access to credentials and external connections.
The Dispatch help page says users should know how to quickly disconnect or revoke access before turning the feature on, but, as The Hacker News notes, it does not explain how.