"Anthropic is retiring Dispatch, but not the design behind it," the researchers at Forever Security wrote.
Forever Security's demonstration of a cross-device attack
Researchers at endpoint-security firm Forever Security showed how a malicious or compromised browser extension that can execute scripts on claude.ai could use the Claude Dispatch feature to make Claude Desktop run code on a signed-in computer. The technical write-up was authored by researcher Gal Weizman and describes a live proof-of-concept in which a script on the claude.ai web page opened Dispatch and sent Claude four prompts that ultimately caused the desktop agent to run system-level commands.
How Dispatch and Claude Desktop interacted in the test
The attack required two specific preconditions: an extension able to run scripts on claude.ai, and a person signed in to both claude.ai and Claude Desktop with Dispatch enabled. Dispatch is a Claude feature that lets users send tasks from a phone to Claude Desktop; it only works while the desktop app is open and the computer is awake. In the test the script delivered prompts asking Claude to install an npm package.
According to the researchers, Claude initially hesitated over the unfamiliar package, but a follow-up message "delivered in the user's voice" persuaded the agent to proceed. The approval prompts Claude issued appeared inside the web page the extension controlled, and the script clicked any "Allow" button every second. Claude then executed a global npm install; the package's install script opened the Calculator app. Forever Security noted that no browser exploit was needed for that step, and that the same sequence could have been used to steal files or install a backdoor, given Claude Desktop's permissions.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAnthropic's response and current product status
Forever Security reported the flaw to Anthropic on May 14; the company accepted the report as valid on May 19 but marked the submission as a duplicate of an internally discovered issue, the researchers say. Anthropic told the researchers on October 13 that it would retire Dispatch, with the end of October targeted for the retirement date. The Dispatch help page, last updated "late last week" according to the researchers, does not mention retirement. It does state that Dispatch is "closed to new users" and that people who already use it on some Pro, Max, and Ultra plans "can keep using it for now."
The researchers cautioned that retiring Dispatch does not remove the underlying design pattern: they identified two other Claude features—Claude Code Remote Control and Claude Cowork sessions—that would let extensions carry out the same attack model. Their write-up does not include tests of those features; they said they plan a follow-up post.
Practical steps for Dispatch users and administrators
- Turn off cross-device Dispatch if you do not need it; if you do need it, review how devices are paired, approved, and removed. Dispatch appears in the Claude Desktop left-side panel as part of Cowork.
- Treat browser extensions like other software: check permissions, control installations, and review updates that increase access. An extension can be malicious, receive a compromised update, or simply have a security flaw that enables abuse.
- Monitor what AI agents do on the computer, looking for unexpected package installations, setting changes, access to credentials, and external connections. The researchers emphasize that Dispatch only functions while the desktop app is open and the computer is awake, which constrains but does not eliminate the risk.
- The Dispatch help page advises users should "know how to quickly disconnect or revoke access before turning the feature on," but does not explain how to do that; users should therefore confirm procedures for disconnecting paired devices and revoking access in their own environments.
What this means for technologists, enterprises, and end users
Technologists and security teams should treat cross-device agent features as extensions of endpoint attack surface: the chain demonstrated required no browser exploit, only a web-page-level script combined with agent permissions. Enterprises that permit personal accounts on work machines risk bridging home and work environments if a single Claude account has Dispatch enabled on both a personal device and a corporate laptop; Forever Security reported seeing personal Claude accounts with cross-device Dispatch turned on, on work computers at its customers.
End users should weigh the convenience of cross-device Dispatch against the demonstrated risk, audit extensions that run on claude.ai, and follow the researchers' recommendations to disable Dispatch where unnecessary and to review paired devices and approval workflows.
Forever Security's demonstration underscores that retiring one feature does not automatically eliminate a class of risk if similar interaction patterns remain in other product functionality. For now, users and administrators can follow the researchers' concrete mitigations and monitor later posts from the researchers about Claude Code Remote Control and Claude Cowork sessions.
https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html
