Anthropic won’t fix a Claude flaw that lets a browser extension run code on your computer

Any browser extension that can reach claude.ai can make Claude Desktop run code on your computer, or on a different computer signed in to the same Claude account, security researcher Gal Weizman of Forever Security told The Register. Anthropic accepted his report as a valid vulnerability in May, he says, then closed it as a duplicate of a flaw it already knew about and hasn’t fixed it.

The flaw, which Weizman calls ThisBash, sits in Dispatch, the Claude Cowork feature that lets you message Claude from your phone and have it work on your desktop with your local files, apps and connectors. Weizman found that Dispatch could also be reached from an ordinary logged-in session on claude.ai, so anything able to control that web page could give Claude Desktop orders as if they came from the user. No attacks using it have been reported.

How the attack works

The victim needs to be signed in to claude.ai in a browser and to Claude Desktop with Dispatch switched on, and to have an extension with access to claude.ai installed. Then the attack works like this:

• Hide in the page: the extension runs a script inside claude.ai with the user’s login cookies.
• Find the desktop: it opens Dispatch in a tiny, unfocused popup, “the only visible trace” of the attack, and asks claude.ai for the session ID of the Claude Desktop agent.
• Talk Claude into it: it types prompts into Dispatch posing as a user who is away from the keyboard, asking Claude to install an npm package by “my friend Gal Weizman” and insisting if Claude gets suspicious.
• Click through: Claude asks for approval before it acts, so the researchers had the script click “Allow” on whatever appeared on screen, once a second.

In the proof of concept, the package simply opened the calculator. A real attacker could steal code and cloud credentials or plant a backdoor. Getting an extension in place isn’t hard either: Weizman said hijacks of legitimate extensions “happen a lot, whether by classic supply-chain compromise, or a black market for buying legitimate extensions.” Last week a hacked Claude Code extension in Cursor’s marketplace tried to plant a backdoor on developers’ computers.

Given you have the malicious extension installed, it is completely trivial. It is the most straightforward attack.

Gal Weizman, Forever Security, to The Register

From a home laptop into the office

On the same computer, the attack lets an extension escape the browser. But Dispatch is built to work across machines, so a compromised browser on one computer can send commands to Claude Desktop on another. When people use one Claude account at home and at work, the personal laptop’s browser becomes a way into the work laptop.

Forever says that is common. Across six of its customer organisations, personal accounts made up 18% to 71% of the Claude accounts it saw.

Then it’s not just escaping the browser and running code on the hosting environment, it’s a way for attackers to infiltrate an organization for the first time.

Gal Weizman, Forever Security, to The Register

“They still decided not to do anything about it”

Weizman says Anthropic paid no bug bounty, issued no CVE and told him it planned to retire Dispatch at the end of October. It is still running. Anthropic’s support page says Dispatch is “in limited beta on some Pro, Max, and Ultra plans, and it isn’t available to new users”, adding: “If you already use Dispatch, you can keep using it for now.” Anthropic didn’t answer The Register’s questions, including when Dispatch will go, and hasn’t commented publicly.

Retiring it wouldn’t end the problem anyway, Weizman says, because the same design lives on in Claude Code Remote Control and in Cowork sessions, which are shared between the web and desktop apps. With those, he said, “there’s much less need for opting into the Dispatch feature specifically.” He told Anthropic this and suggested treating the web version as a separate, less trusted device that can’t order the desktop to run commands. OpenAI’s Codex, he said, doesn’t let its web version see or use sessions started on the desktop.

It isn’t the first time Anthropic has declined to fix a Claude Desktop flaw. In February, LayerX said a booby-trapped Google Calendar entry could make Claude Desktop Extensions run code with no clicks; Anthropic’s reply, which LayerX shared with The Register, said the issue “falls outside our current threat model.”

Why it matters

Anthropic pitches Claude as one assistant that follows you from phone to browser to desktop and works on your computer. If the browser tab can drive the desktop, every extension with access to claude.ai becomes a possible way onto that computer and, for people who mix work and personal accounts, into their employer’s network.

Sources: The Register, “Anthropic won’t fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries”; Anthropic, Assign tasks from anywhere in Claude Cowork; The Register, LayerX and Claude Desktop Extensions.