Forever Security says a browser extension with access to claude.ai can use Claude Dispatch to send prompts as you and get Claude Desktop to install software on any computer linked to your account. It calls the flaw ThisBash. Anthropic plans to retire Dispatch; until then, turn off cross-device Dispatch if you don't use it and audit your extensions.
If you use Claude Dispatch, turn it off on any computer that doesn’t need it, and check which browser extensions can read claude.ai. Security firm Forever Security published research on November 4 showing that a browser extension with script access to claude.ai can send prompts to Claude Desktop as you and get it to run commands on your computer. The firm calls the flaw ThisBash. It is a proof of concept: the researchers report no attacks in the wild, and there is no CVE.
What Dispatch is and who is exposed
Dispatch is the Claude feature that lets you send a task from your phone or browser to Claude Desktop, which then works on your computer. It sits inside Cowork in the desktop app. According to The Hacker News, Dispatch is closed to new users, and people already using it on some Pro, Max and Ultra plans can keep using it for now.
You are exposed if Dispatch is linked to a desktop and a browser where you are signed in to claude.ai runs an extension that can run scripts on that site. Because Dispatch links devices, the researchers say the computer that runs the commands can be a different machine signed in to the same Claude account.
What to do now
- Turn off cross-device Dispatch if you don’t use it. If you do, review which devices are paired and remove the ones you don’t recognize. These are the researchers’ recommendations.
- Audit browser extensions in the browser you use for claude.ai. Remove any you don’t need, and be wary of any that asks for access to all sites.
- Watch for unexpected installs. The researchers suggest monitoring agent activity for package installs, setting changes and new outbound connections. On a work fleet, treat AI agents and the accounts they use like any other endpoint software.
How the attack works
According to Forever Security’s write-up by researcher Gal Weizman, the extension opens Claude’s Cowork agent page in a small unfocused popup, reads the ID of the local Claude Desktop session and types prompts into it under your logged-in session. In the test, Claude hesitated at installing an npm package. A follow-up prompt written in the user’s voice got it to go ahead, and a script clicked every “Allow” button that appeared. Claude then installed a test package whose install script opened Calculator. No browser exploit was needed.
The researchers describe the root problem as a missing authorization boundary: a logged-in web session was treated as permission to run local commands. They say Claude Code Remote Control and Cowork sessions allow the same attack, though they did not test those and plan a follow-up.
Anthropic is retiring Dispatch, and the design question stays open
The researchers say they reported the issue to Anthropic on May 14, 2026. Anthropic confirmed it on May 19 and closed it as a duplicate of an issue it had already found internally. On October 13, per the researchers, Anthropic said it would retire Dispatch, targeting the end of October. The Hacker News reports that Dispatch’s help page does not mention a retirement and that the flaw can still be exploited. Anthropic has not published an advisory, and neither source quotes a statement from the company.
The researchers’ line is that “Anthropic is retiring Dispatch, but not the design behind it.” That matters beyond one feature. Any agent you can steer from a browser tab inherits the trust of everything that runs in that browser, extensions included. It is the second extension-related Claude security story in two weeks: on October 29, a backdoored Claude Code extension went out through Cursor’s marketplace. If your team runs AI agents with access to its machines, the browser extension list is now part of your security review.