Most people think of a browser extension as a small convenience. A password manager, an ad blocker, a tool that fixes some annoyance on a website.

Forever Security just showed that one extension on claude.ai is enough to make Claude Desktop execute commands on your computer, using your own signed-in session as the delivery mechanism.

The researchers demonstrated this against Dispatch, a Claude feature that lets you send tasks from your phone to the desktop app. The flaw itself can still be exploited, they said earlier this week, even though Anthropic has said Dispatch is being retired.

What Dispatch Actually Does

Dispatch is a bridge. You send a task from your phone, and Claude Desktop picks it up and runs it on your machine.

That is a legitimate feature. The problem is that Claude Desktop is an AI agent with real permissions on your system. It can run commands. It can install software. It can touch files.

Once Dispatch accepts instructions from anywhere other than the phone app, the trust boundary shifts. And that is exactly what the researchers found.

The Flaw in Plain Terms

Dispatch accepted an ordinary signed-in session on claude.ai. The website showed no link to it. No button. No visible UI suggesting that dispatch was reachable from the web page.

But it was reachable. And that meant any extension running on claude.ai could send Claude Desktop instructions as if the user had typed them.

The attack requires two things.

Dispatch only works while the computer is awake and the desktop app is open. That limits the window, but it does not close it.

How the Demonstration Played Out

The researchers ran the test with the browser and Claude Desktop on the same machine. Here is the sequence.

A script on the user's claude.ai page opened Dispatch and sent four prompts to Claude, written as if they came from the user. The prompts asked Claude to install an npm package.

Claude hesitated. The package was unfamiliar, and the agent flagged it.

Then a follow-up message arrived, delivered in the user's voice. Claude went ahead.

This is the part that matters. Claude does ask before it acts. But those approval prompts appeared in the web page the extension controlled. The script clicked any "Allow" button every second, so nobody had to be watching.

Claude ran a global npm install. The package's install script opened the Calculator app.

No browser exploit was needed. And as the researchers noted, the same step could have stolen files or installed a backdoor, given Claude's permissions on the computer.

The Cross-Device Problem

The test was run with both pieces on the same computer. But Dispatch connects devices.

That means an extension on claude.ai could reach Claude Desktop on a different computer signed in to the same Claude account. The researchers describe that case but did not demonstrate it.

The scenario worth thinking about is a personal Claude account used on both a home machine and a work laptop. If Dispatch is enabled and cross-device is on, a compromised extension on the home machine could issue instructions to the work laptop.

Forever Security says it has seen personal Claude accounts with cross-device Dispatch enabled on work computers at its customers.

Anthropic's Response

The researchers reported the flaw on May 14. Anthropic accepted it as valid on May 19, then closed the report as a duplicate of an issue it had already found internally.

Anthropic told the researchers on October 13 that Dispatch would be retired by the end of October. The Dispatch help page, last updated late last week, does not mention a retirement. It says Dispatch is closed to new users, and that existing users on some Pro, Max, and Ultra plans "can keep using it for now."

The researchers' assessment is pointed. Anthropic is retiring Dispatch, but not the design behind it. They add that two other Claude features, Claude Code Remote Control and Claude Cowork sessions, let extensions carry out the same attack. Their write-up does not include a test of those features.

Why the Retiring of One Feature Is Not Enough

If the underlying design pattern is "a web session can send instructions to a local agent," then retiring one entry point does not fix the pattern. It just changes the address.

That is the researchers' argument, and it is the one defenders should weigh. The question is not whether Dispatch specifically remains available. The question is whether any web-reachable surface can hand instructions to an agent with local permissions.

What Users Should Do Right Now

• Turn off cross-device Dispatch if you do not need it. If you do need it, review how devices are paired, approved, and removed. The Dispatch help page tells you to know how to disconnect or revoke access, but does not explain how. Find that answer before you need it.
• Treat browser extensions as software with real privileges. Check what they can access, control what gets installed, and review updates that expand their permissions. An extension that gains new capabilities in an update is a new risk.
• Monitor what AI agents do on your machine. Unexpected package installations, setting changes, credential access, and new outbound connections are all signals.
• Separate work and personal accounts. If cross-device Dispatch is on a personal account that also signs in on a work laptop, the boundary between those environments is thinner than it looks.
• Do not rely on approval prompts alone. The demonstration showed that a script can click "Allow" as fast as the prompt appears. Approval is only meaningful if a human is the one approving.

The Bigger Pattern

AI agents with local permissions are now common. Claude Desktop, coding assistants, and automation tools all sit on machines with access to files, credentials, and network.

Every path that lets instructions reach those agents from outside is a trust boundary. Dispatch was one. The researchers argue others remain.

That does not mean the features are inherently unsafe. It means the design needs to assume that anything running in a web page might be adversarial, including extensions the user installed for unrelated reasons.

FAQ

What is the Claude Desktop Dispatch vulnerability?

A design flaw that let a browser extension running on claude.ai send instructions to Claude Desktop through Dispatch, using the user's own signed-in session, without a visible link or button on the website.

Do I need a malicious extension?

Not necessarily. The extension could be malicious, a legitimate one that received a compromised update, or a legitimate one with its own security flaw. The point is that any extension with script access to claude.ai could reach Dispatch.

Did Claude actually run the code?

Yes. In the demonstration, Claude hesitated over an unfamiliar npm package, then proceeded after a follow-up message in the user's voice. It ran a global npm install, and the package's install script opened the Calculator app.

Why did the approval prompt not stop it?

Because the prompt appeared in the web page the extension controlled. The script clicked "Allow" every second, so no human interaction was needed.

Is Dispatch still vulnerable?

Anthropic told the researchers Dispatch would be retired by the end of October. The help page says it is closed to new users but existing users can keep using it for now. The researchers say the underlying design still applies to Claude Code Remote Control and Claude Cowork sessions.

Could this reach a different computer?

Yes, in theory. Dispatch connects devices, so an extension could reach Claude Desktop on another machine signed in to the same account. The researchers described that case but did not demonstrate it.

What should I do if I use Dispatch?

Turn off cross-device Dispatch if you do not need it. If you do need it, know how to revoke access. Review your browser extensions. And monitor what your AI agent does on the machine.

Did Anthropic fix the underlying issue?

The researchers say Anthropic retired Dispatch but not the design behind it, and that two other Claude features allow the same attack. Their write-up does not include a test of those features.

Source: The Hacker News