A vulnerability in Anthropic’s Claude products lets any browser extension that can control Claude Dispatch make Claude Desktop run code on the computer – or even a different machine signed into the same Claude account – with no browser exploit and minimal user interaction required. Anthropic, aware of the problem since May, has taken no action to close the hole. Dispatch is a feature in Claude that lets users send and manage tasks from their mobile phone or browser to Claude Desktop, an AI agent that runs commands on their computer. Forever Security researcher Gal Weizman discovered that Claude Dispatch’s interface and API were reachable from an ordinary logged-in web session at claude.ai. So a browser extension able to control claude.ai could send commands to Claude Desktop as if they came from the legitimate Dispatch user. “That extension was able to perform a classic escalation of privileges. Because now Claude has access to the files in the operating system, it can run code on the operating system and compromise the machine completely,” said Weizman. “We’re talking about millions of installs.” Claude.ai received about 950 million monthly visits as of mid-2026, and Cowork usage included 1.2 million sampled sessions from more than 600,000 organizations during May, according to Anthropic’s usage data. Weizman found and disclosed the Claude Dispatch flaw, dubbed ThisBash, to Anthropic, and shared his research exclusively with The Register. The AI company acknowledged his repo...
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries
Affected Software
Frequently Asked Questions
Who could be affected by this flaw?
Users with Claude Desktop signed in to the same Claude account as an exposed Claude Dispatch session could be affected. The issue could also reach a different machine signed in to that account.
What does an attacker need to exploit the issue?
An attacker would need a browser extension capable of controlling claude.ai from an ordinary logged-in web session. The article says no browser exploit is required and that minimal user interaction is needed.
What could exploitation allow?
The extension could send commands to Claude Desktop while appearing to be the legitimate Dispatch user. Because Claude Desktop can run commands and access operating-system files, the researcher said this could enable code execution and full machine compromise.
Has Anthropic fixed the reported vulnerability?
No. The article says Anthropic has known about the issue since May and has taken no action to close it.