The Claude Dispatch flaw lets a malicious browser extension make a user’s Claude Desktop app run code, without exploiting any browser bug. Researcher Gal Weizman of Forever Security described it on November 6, 2026, according to The Hacker News. He says it is still exploitable, and the information on Anthropic’s position differs between sources.
No real-world exploitation has been reported so far, according to Daily Security Review, and no CVE has been assigned. Here is how the attack works, what is established about the fix and what you can do.
How does the Claude Dispatch flaw work?
Dispatch is a feature that sends tasks from a phone to Claude Desktop. According to Forever Security, cited by The Hacker News, Dispatch accepted an ordinary signed-in claude.ai session, even though the site showed no link to it. An extension able to run scripts on claude.ai could therefore send instructions to Claude Desktop as if the user had typed them.
In the demonstration, the script asked Claude to install an npm package and clicked the approval buttons at regular intervals until the install script opened the Calculator. The researchers believe the same access could be used to steal files or install a backdoor. The name “ThisBash” is given to the attack by AI Weekly and Magica, not by The Hacker News.
What conditions are needed to exploit the Claude Dispatch flaw?
Three things are needed: an extension that can run scripts on claude.ai, a user signed in to claude.ai and a Claude Desktop app with Dispatch enabled. The computer must also be awake and the app open, according to The Hacker News. The risk does not depend on a browser defect, but on the trust given to an already authenticated web session.
The point that worries Weizman most, according to AI Weekly, is the link to the cloud: a compromised claude.ai session could send commands to a Claude Desktop on another machine, even inside another boundary, such as a work computer tied to the same account. The Hacker News describes this scenario as described but not demonstrated.
Has Anthropic fixed the Claude Dispatch flaw?
No fix is confirmed to date. According to The Hacker News, Weizman reported the flaw on May 14 and Anthropic accepted it on May 19, before closing it as a duplicate of an internal issue. AI Weekly, which relays an article from The Register, adds that Anthropic paid no bounty or assigned a CVE, and that it said it planned to retire Dispatch at the end of October 2026.
- Status of the flaw: “fixed” nowhere. Daily Security Review writes that Anthropic had not yet acted to close it as of November 5, while The Hacker News and AI Weekly speak of a report closed as a duplicate.
- Refusal to fix: some headlines speak of a refusal, but Tech Insider points out that this claim is reported, not independently confirmed, and that no official Anthropic statement was found.
- Dispatch retirement: The Hacker News says the help page does not mention a retirement and only states that the feature is closed to new users. According to Let’s Data Science, it was still in limited beta on October 30 for some Pro, Max and Ultra plans.
- Anthropic’s reply: the company did not answer The Register’s questions, according to Let’s Data Science. We do not have its side.
Other Claude features that may be affected
According to the researchers, Claude Code Remote Control and Claude Cowork sessions might allow the same attack, but they did not test them, per The Hacker News. Weizman also believes that retiring Dispatch would not remove the underlying design weakness, as Let’s Data Science reports. Magica names no other affected feature and notes that the demonstration says nothing about the security of cloud-based Cowork.
Our analysis: the real issue is trust in a web session
This section is our analysis. The problem looks less like an isolated bug than a question of principle: when an agent can run commands on your machine, everything that can talk to it (web session, extension, paired device) becomes an entry point. The attack requires a malicious or compromised extension, a realistic prerequisite, since Weizman notes that extension hijacks “happen a lot”, through supply-chain compromise or the purchase of legitimate extensions.
We already saw this pattern in our article on running Claude Code without a sandbox using Docker sbx: limiting what an agent can do is more reliable than counting on trust in the workstation.
How to protect yourself from the Claude Dispatch flaw
Reduce what can reach your agent. The researchers recommend, according to The Hacker News, disabling cross-device Dispatch if you do not need it, reviewing extension permissions and updates, and monitoring agent activity. Here are concrete steps:
- Disable Dispatch and remote control if you do not use them. On a managed workspace, keep Remote Control off without a business need, according to Tech Insider.
- Prune your extensions: remove those you no longer use, and check their permissions on claude.ai and their recent updates.
- Separate uses: use a dedicated browser profile with no extensions for claude.ai.
- Do not auto-approve permission requests, and watch for package installs or credential access you did not ask for.
- Limit secrets in the agent’s environment (production keys, tokens) and use a sandbox where possible.
Frequently asked questions about the Claude Dispatch flaw
A flaw described by Gal Weizman of Forever Security that lets a browser extension with access to claude.ai send instructions to Claude Desktop through Dispatch, and thereby run code on the machine.
No fix is confirmed. The researchers say it remains exploitable, and sources differ on Anthropic’s position, which we could not verify directly.
No, according to The Register as relayed by AI Weekly, no CVE has been assigned.
Disable Dispatch if you do not use it, limit and review your extensions, use a dedicated browser profile and do not auto-approve permission requests.
