Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers Swati KhandelwalNov 06, 2026Artificial Intelligence / Browser Security A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test. The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The flaw that makes this possible can still be exploited, the researchers said earlier this week. Claude Desktop is an AI agent that can run commands on the computer where it is installed. The researchers found that Dispatch also accepted an ordinary signed-in session on claude.ai, the Claude website, even though the site showed no link to it. That let an extension running on the site send Claude Desktop instructions as if the user had sent them. The researchers say Anthropic, the company that makes Claude, told them on October 13 that Dispatch would be retired, with the end of October as the target. The Dispatch help page, last updated late last week, does not mention a retirement. It says Dispatch is closed to new users and that people who already use it on some Pro, Max, and Ultra plans "can keep using it for now." The attack needs two things, according to a technical write-up by Forever Security researcher Gal Weizman: an extension that can run scripts on claude.ai, and a person signed in to both claude.ai and Claude Desktop with Dispatch turned on. The extension could be malicious, a legitimate one that received a compromised update, or a legitimate one with a security flaw. Dispatch itself only works while the computer is awake and the desktop app is open. In the test, a script on the user's claude.ai page opened Dispatch and sent Claude four prompts as if it were the user. The prompts asked Claude to install an npm package. Claude first hesitated over the unfamiliar package, but a follow-up message, delivered in the user's voice, got it to go ahead. Claude asks before it acts, but those approval prompts appeared in the web page the extension controlled. The script clicked any "Allow" button every second, so no one had to be watching. Claude then ran a global npm install, and the package's install script opened the Calculator app. No browser exploit was needed. The same step could have stolen files or installed a backdoor, given Claude's permissions on the computer, the researchers say. The test was run with the browser and Claude Desktop on the same computer, and the researchers report no real attacks. Because Dispatch connects devices, the extension could also reach Claude Desktop on a different computer signed in to the same Claude account, they say. That case is described but not shown. The same reach could link a home computer to a work laptop when someone uses a single personal Claude account on both devices, with Dispatch turned on. The researchers have seen personal Claude accounts with cross-device Dispatch turned on, on work computers at their customers. The researchers reported the flaw to Anthropic on May 14. The company accepted it as valid on May 19 but closed the report as a duplicate of an issue it had already found internally, according to the researchers. "Anthropic is retiring Dispatch, but not the design behind it," the researchers wrote, adding that two other Claude features, Claude Code Remote Control and Claude Cowork sessions, let extensions carry out the same attack. Their write-up does not include a test of those features, and they plan a follow-up post. In Claude Desktop, Dispatch is part of Cowork and appears in the left-side panel. The Dispatch help page says users should know how to quickly disconnect or revoke access before turning the feature on, but it does not explain how. Turn off cross-device Dispatch if you do not need it. If you do need it, review how devices are paired, approved, and removed. Treat browser extensions like other software on the computer: check their permissions, control what gets installed, and review updates that give them more access. Monitor what AI agents do on the computer, including unexpected package installations, setting changes, access to credentials, and external connections. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, browser security, endpoint security, Vulnerability PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits AI-Generated Fake Login Pages Are Making Account Takeovers Easier The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Reserve My Spot Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Accelerate Incident Response: 95% Faster Containment Cut containment time from 48 hours to 3. Read the Orchid IR case study. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. Your Attack Surface Is Growing Faster Than Your Team Can Respond PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security