Researcher Says Anthropic Left Claude Dispatch Flaw Unfixed Despite Remote Code Risk

Gal Weizman, a researcher at Forever Security who calls the flaw ThisBash, shared his findings exclusively with The Register. He reported the issue to Anthropic in May. According to The Register, Anthropic accepted it as a valid vulnerability but closed the report as a duplicate of a known issue it was already tracking, paid no bug bounty and assigned no CVE. It told the researcher it planned to retire Dispatch at the end of October.

The feature is still running. As of October 30, Anthropic's support page listed Dispatch as available in limited beta on some Pro, Max and Ultra plans. New users cannot sign up, but existing users "can keep using it for now", the page says. Anthropic did not respond to The Register's questions, including about when Dispatch will be switched off. Weizman said that after he sent his full findings, the company "still decided not to do anything about it."

The Attack Chain

The problem, as Weizman describes it, is that Dispatch's interface and API can be reached from an ordinary logged-in session on claude.ai. Any browser extension that can control that page can therefore send commands to Claude Desktop as if they came from the legitimate user. No browser exploit is needed.

In his write-up, the extension injects a script into the claude.ai page that shares its JavaScript context and session cookies. It opens Dispatch in a tiny, unfocused popup, uses the user's cookies to look up the session ID of the desktop agent, and places prompts in the composer telling the agent what to do. It then clicks "Allow" once a second so approval prompts do not stall the chain, rewording its instructions until the agent runs code. The researchers describe success as a matter of "when, not if."

The proof of concept ran a global npm install of a malicious package whose install hook opened the calculator app. A real attacker could use the same route to steal source code or cloud credentials, or to plant a backdoor, Weizman said.

The attack requires a compromised extension with access to claude.ai and a user signed in to both Claude on the web and Claude Desktop with Dispatch turned on. Weizman argues that hijacked extensions are common, whether through supply-chain compromises or purchases on black markets.

Personal Accounts on Work Machines

Because Dispatch works across machines, a compromised browser session could reach a desktop elsewhere. That matters most for companies whose staff use one Claude account on personal and work devices: an attacker who controls an extension on a home computer could move onto a corporate laptop.

Forever Security said data from six organisations, which it described as a small subset of its customers, showed personal accounts making up between 18% and 71% of the Claude accounts seen in their corporate environments. In one case, 255 of 1,233 accounts were personal.

Weizman also said retiring Dispatch would not fully close the gap, because Claude Cowork sessions and Claude Code Remote Control expose similar paths from the web to the desktop. His proposed fix is for Anthropic to treat the web client as a separate device with lower permissions, so that risky actions started there are blocked. He pointed out that OpenAI's Codex does not share sessions between its web and desktop versions, which avoids the problem.

Until Anthropic says more, the practical steps for security teams are to review which browser extensions can access claude.ai, check whether Dispatch is still enabled for their users, and separate personal Claude accounts from corporate ones.