"That extension was able to perform a classic escalation of privileges. Because now Claude has access to the files in the operating system, it can run code on the operating system and compromise the machine completely," said Forever Security researcher Gal Weizman.
What the flaw is and how it works
Weizman discovered a vulnerability in Anthropic’s Claude products that lets any browser extension capable of controlling the claude.ai web interface send commands to Claude Desktop as if they came from the legitimate Dispatch user. Dispatch is a Claude feature that lets users send and manage tasks from a mobile phone or browser to Claude Desktop, an AI agent that runs commands on the user's computer.
Weizman found that Claude Dispatch’s interface and API were reachable from an ordinary logged-in web session at claude.ai. A malicious or hijacked browser extension that registers a MAIN-world content script on claude.ai can share the page’s JavaScript context and the user’s session cookies, open a tiny, unfocused popup pointing at Dispatch, query sessions (GET /v1/sessions?tags=cowork-dispatch-local), obtain the Desktop agent’s session ID, and then "force prompt" the agent until it executes actions on the host.
The six-step attack chain and a working PoC
- The extension installs a MAIN-world content script on claude.ai and gains the page's JS context and cookies.
- The script opens Dispatch (https://claude.ai/cowork/agent) in a small, unfocused popup — the only visible trace, the researcher says.
- The script calls GET /v1/sessions?tags=cowork-dispatch-local and receives the Claude Desktop agent session ID.
- The script begins “force prompting,” repeatedly posting prompts into the agent’s composer to instruct it to run code or access files.
- If Claude asks for confirmation, the script uses a one-second interval click to automatically press “Allow” whenever a prompt approval appears.
- The script repeats and rephrases prompts until remote code execution (RCE) is achieved on the desktop or on another machine connected to the same account.
In Weizman’s proof-of-concept, the chain culminated in Claude running npm install -g "add-colors-to-bash" — a package with a preinstall.js hook that opened the calculator app. The write-up warns that a real attacker could use the same path to install malware that steals source code or cloud credentials or to place a backdoor on a target machine.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhy shared sessions and Dispatch widen the blast radius
Dispatch was designed to connect multiple endpoints: desktop, mobile, and web share sessions. That connectivity is what Weizman says makes the design powerful — and dangerous. The Dispatch and Claude Cowork designs let a browser session control a Desktop agent on the same machine or on a different machine signed into the same Claude account, turning a compromised browser extension into a remote entry point.
This is particularly consequential when personal and corporate machines share accounts. Forever Security’s data, shared with The Register, shows personal Claude accounts present in corporate environments across six organizations: one example had 255 of 1,233 known Claude accounts personal (18 percent); another had 214 of 695 accounts personal (31 percent); a small environment of 28 known accounts had 20 personal accounts (71 percent). The attacker path can therefore become a way to jump from a user’s personal browser into corporate desktops.
Anthropic’s response, timeline, and unresolved design choice
Weizman disclosed the flaw, dubbed ThisBash, to Anthropic in May. Anthropic acknowledged the report as a valid vulnerability but closed it as a duplicate of a known issue it was already tracking; the company did not pay a bug bounty or issue a CVE for Weizman’s finding. Anthropic told the researcher it planned to retire Dispatch at the end of October — a change that did not happen.
As of October 30, Anthropic’s official support page listed Dispatch as available in limited beta on some Pro, Max, and Ultra plans but not available to new users, and stated: “If you already use Dispatch, you can keep using it for now.” The Claudefather (an Anthropic representative) did not respond to The Register’s questions about timing for retiring the feature.
Weizman told The Register he also warned Anthropic that the underlying design issue — shared sessions and equivalent permissions across web and desktop — survives Dispatch in other features such as Claude Code Remote Control and Claude Cowork sessions. “They still decided not to do anything about it,” he said.
What this means for security teams, enterprises, and end users
Technologists and security teams: The immediate vector requires a browser extension with access to claude.ai, but the exploit path is straightforward once that prerequisite is met. Security teams should prioritize controls around browser extension inventories, supply-chain integrity for extensions, and monitoring of cross-device account use — details emphasized by Weizman’s demonstration.
Affected enterprises and procurement leaders: Enterprises that allow or tolerate personal Claude account use on corporate endpoints face a lateral-movement risk. The documented account-sharing percentages show this is already common in some environments; procurement choices about which AI features to enable or allow on employee accounts will materially affect exposure.
End users and the general public: An attacker who hijacks or distributes a malicious extension could — with minimal visible traces — send commands to a Desktop agent. Users running Dispatch, Cowork, or Claude Code and those who reuse accounts across personal and work devices should assume that web sessions can reach desktop agents unless product-level permissions are explicitly segmented.
Weizman recommended a straightforward mitigation: treat web sessions as devices with inferior security permissions compared with desktop instances, preventing the web interface from instructing a desktop agent to perform out-of-scope actions. He noted other agents such as OpenAI’s Codex do not share sessions between web and desktop, a design that eliminates this specific class of abuse.
Anthropic’s decision not to close this particular hole — and to leave shared-session designs intact in other features — leaves a clear trade-off between convenience and a new cross-device attack surface. The record here closes with a researcher’s proof-of-concept, a vendor acknowledgement that stopped short of a fix, and a live feature that remains available to existing users.
