Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries

A vul­ne­ra­bi­lity in Anth­ro­pic’s Clau­de pro­ducts lets any brow­ser ex­ten­sion that can con­trol Clau­de Dis­patch make Clau­de Desk­top run code on the com­pu­ter – or even a dif­fe­rent ma­chi­ne sig­ned into the same Clau­de ac­count – with no brow­ser ex­ploit and mi­ni­mal user in­ter­ac­tion re­qui­red. Anth­ro­pic, aware of the pro­blem since May, has taken no ac­tion to close the hole. Dis­patch is a fea­tu­re in Clau­de that lets users send and ma­na­ge tasks from their mo­bi­le phone or brow­ser to Clau­de Desk­top, an AI agent that runs com­mands on their com­pu­ter. Fo­re­ver Se­cu­rity re­sear­cher Gal Weiz­man dis­co­ve­red that Clau­de Dis­patch’s in­ter­fa­ce and API were reacha­ble from an or­di­nary log­ged-in web ses­sion at clau­de.ai. So a brow­ser ex­ten­sion able to con­trol clau­de.ai could send com­mands to Clau­de Desk­top as if they came from the le­gi­ti­ma­te Dis­patch user. “That ex­ten­sion was able to per­form a clas­sic es­ca­la­tion of pri­vi­le­ges. Be­cau­se now Clau­de has ac­cess to the files in the ope­ra­ting sys­tem, it can run code on the ope­ra­ting sys­tem and com­pro­mi­se the ma­chi­ne com­ple­tely,” said Weiz­man. “We’re tal­king about mi­llions of ins­talls.” Clau­de.ai re­cei­ved about 950 mi­llion monthly vi­sits as of mid-2026, and Co­work usage in­clu­ded 1.2 mi­llion sam­pled ses­sions from more than 600,000 or­ga­ni­za­tions du­ring May, ac­cor­ding to Anth­ro­pic’s usage data. Weiz­man found and dis­clo­sed the Clau­de Dis­patch flaw, dub­bed This­Bash, to Anth­ro­pic, and sha­red his re­search ex­clu­si­vely with The Re­gis­ter. The AI com­pany ack­now­led­ged his re­port as a valid vul­ne­ra­bi­lity in May, but clo­sed the se­cu­rity issue as a du­pli­ca­te of a known flaw it was al­ready trac­king. Anth­ro­pic did not pay Weiz­man a bug bounty or issue a CVE, but told him it plan­ned to re­ti­re Dis­patch at the end of Oc­to­ber. That didn’t hap­pen. The Clau­de­father did not res­pond to The Re­gis­ter’s ques­tions – in­clu­ding when it plan­ned to re­ti­re the fea­tu­re – but as of Oc­to­ber 30, the of­fi­cial Clau­de sup­port page lis­ted Dis­patch as avai­la­ble in li­mi­ted beta on some Pro, Max, and Ultra plans, but not avai­la­ble to new users. “If you al­ready use Dis­patch, you can keep using it for now,” the page reads. Even if Anth­ro­pic does kill off Dis­patch, Weiz­man says the fun­da­men­tal flaw in Clau­de’s de­sign still exists, and the se­cu­rity weak­ness now lives on in other fea­tu­res like Clau­de Code Re­mo­te Con­trol and Clau­de Co­work ses­sions. The re­sear­cher told us he com­mu­ni­ca­ted all of this to Anth­ro­pic. “They still de­ci­ded not to do anything about it,” Weiz­man said. “Clau­de Co­work is now ac­ces­si­ble via the web ver­sion, and it sha­res the same ses­sions as you can ac­cess in the desk­top ver­sion,” he said. “Once again, using an ex­ten­sion, you can use the Co­work ses­sions to say: ‘Plea­se ac­cess this file and grab it. Plea­se ins­tall this ma­li­cious npm pac­ka­ge. Plea­se run code on the ope­ra­ting sys­tem.’ And it would.” Weiz­man said his re­search “star­ted with a vul­ne­ra­bi­lity. And it ended up being a de­sign choi­ce that enables this at­tack vec­tor very ea­sily.” There is a pre­re­qui­si­te for this at­tack to work: A brow­ser ex­ten­sion with ac­cess to clau­de.ai must be pre­sent. But, as Weiz­man ex­plai­ned, that’s not very dif­fi­cult to achie­ve. How the at­tack works An at­tac­ker could trick so­meo­ne into ins­ta­lling a ma­li­cious ex­ten­sion – but it’s ty­pi­cally ea­sier to just hi­jack a le­gi­ti­ma­te one. Weiz­man told us hi­jacks of this sort "hap­pen a lot, whether by clas­sic supply-chain com­pro­mi­se, or a black mar­ket for bu­ying le­gi­ti­ma­te ex­ten­sions." Next, users must be authen­ti­ca­ted to both Clau­de on the web (clau­de.ai), and Clau­de Desk­top with the Dis­patch fea­tu­re enabled. “But given the Co­work ses­sion dis­co­very, and the Code re­mo­te-con­tro­lled ses­sion dis­co­very, there's much less need for op­ting into the Dis­patch fea­tu­re spe­ci­fi­cally,” Weiz­man said. In a sub­se­quent tech­ni­cal re­port and video proof-of-con­cept ex­ploit, Weiz­man outli­nes the six steps in the at­tack chain.