Forever Security research and The Register report published November 5, 2026; flaw reported to Anthropic May 14, 2026 and acknowledged May 19, 2026
The Extension Drove the Agent: Claude Dispatch Lets a Browser Add-On Run Code on Your Desktop, and on Another Machine Too
The browser sandbox is supposed to be a wall. Research published November 5 by Gal Weizman of Forever Security shows a door in it, built by the product itself. Claude Dispatch, the Claude Cowork feature that lets a user send tasks from a phone or browser to Claude Desktop, an agent that works with local files and runs commands, was also reachable from an ordinary logged-in session on claude.ai. An extension able to control that page could therefore issue instructions to the desktop agent as if they came from the user. In the proof of concept, which the researchers call ThisBash, the extension opens Dispatch in a tiny unfocused popup, reads the desktop agent session identifier using the user ambient cookies, then runs a sequence the researchers call prompt forcing: four prompts that talk the agent past its own hesitation, while a script clicks the Allow approval button once a second whenever it appears. The demonstration ends with Claude installing a package whose install script opens Calculator; the same channel could copy files, plant SSH keys or install a backdoor. The reach is the point. On one machine it is a sandbox escape. Across two machines signed into the same account it is remote code execution on a computer the browser never touched, and when the account is a personal one signed in on a work laptop, the researchers call it what it is: a route into the organization. Anthropic acknowledged the report as a valid vulnerability on May 19, then closed it as a duplicate of a flaw it already tracked; it paid no bounty and issued no CVE identifier, and it told the researcher Dispatch would be retired at the end of October. As of October 30 the support page still listed Dispatch in limited beta on some Pro, Max and Ultra plans, closed to new users, with existing users told they could keep using it for now, and Anthropic did not answer The Register questions, including when the feature will be switched off. Weizman argues the pattern survives Dispatch, pointing to Claude Code Remote Control and Cowork sessions as sharing the same web-to-desktop trust design; that extension of the finding is his assessment, not an Anthropic statement. No exploitation in the wild is reported in the coverage. The scale underneath is not small: claude.ai drew about 950 million monthly visits as of mid-2026, and Anthropic own usage data counted 1.2 million sampled Cowork sessions from more than 600,000 organizations in May.
Executives
An authenticated web session is not the same thing as a user authorizing a command on their machine, and this research is what that sentence costs when a product treats them as equal. The exposure path runs through two things most organizations govern loosely: browser extensions and personal AI accounts on work machines. Forever Security told The Register it routinely finds personal Claude accounts in corporate environments, in six customer organizations ranging from 18 percent to 71 percent of known Claude accounts. Ask how many of your endpoints run Claude Desktop with Dispatch or Cowork enabled, under which accounts, and whether your extension policy would even see the add-on that starts this chain.
CIO / CISO
Set the controls the vendor timeline makes necessary. Disable Dispatch where it is not in active use and treat its continued beta status as an unpatched exposure until Anthropic confirms the retirement actually happened. Put claude.ai inside your extension governance: allowlist extensions with access to AI sites the way you would for mail or banking, because the prerequisite here is an extension, malicious or hijacked, with page access. Separate personal and work AI accounts by policy and by sign-in restriction where the tooling allows it, since the cross-machine path depends on one account spanning both. Log agent approvals as privileged actions in your review process; an approval history is the audit trail this attack writes in plain sight.
Engineers
Reproduce the prerequisites against your own estate before you rate the risk. The chain needs a signed-in claude.ai session, Claude Desktop with Dispatch enabled, and an extension that can register a content script on claude.ai and open a small popup; the session lookup uses the user own cookies, so no credential theft is involved. Check which managed browsers permit extension installs outside the allowlist, whether AI domains are in scope of your extension inventory, and whether desktop agent features are enabled by default in your Claude deployment. If staff use Cowork or Remote Control sessions, review active sessions and connected machines, and treat an unexpected desktop session identifier as an incident lead.
Everyone (non-IT)
If you use Claude at home and at work, keep the accounts separate and be careful with new browser extensions, especially free ones that ask to run on every site. An extension that can act on the Claude website could, under the conditions in this research, ask your desktop Claude to run commands, including on another computer where you are signed in. You do not need to stop using the tools; you do need to know which extensions you have installed, remove the ones you do not recognize, and leave Dispatch off unless you actively use it.