Anthropic has known for six months about a flaw in its Claude AI assistant that lets a malicious browser extension run code on a user's computer — and it has decided not to fix it, according to research published this week.
Security researcher Gal Weizman of Forever Security found that Claude Dispatch, a feature that lets users send tasks from their phone or browser to Claude Desktop, could be reached from an ordinary logged-in session on claude.ai. Any browser extension able to control that web page could then issue commands to Claude Desktop as though they came from the legitimate user — even on a different machine signed into the same Claude account.
Weizman, who calls the technique "ThisBash", disclosed the flaw to Anthropic on May 14. The company confirmed it was a valid vulnerability on May 19, but closed the report as a duplicate of a problem it was already tracking. It paid no bug bounty and issued no CVE identifier. Anthropic told Weizman it planned to retire Dispatch at the end of October. That date has passed, and the feature is still running.
How the attack works
Dispatch is designed to let a user message Claude from their phone and have it work on their desktop, using local files, apps and connectors. The problem, Weizman found, is that the same workflow was never sealed off from the web. Claude Desktop is built on the same web interface and API as claude.ai, and the web version merely hid the Dispatch link — it never blocked access to it.
In a proof of concept, a browser extension opened Dispatch in a tiny 200-by-200-pixel unfocused popup — the only visible trace of the attack — then called the sessions endpoint with the user's own cookies to find the desktop agent. It then typed instructions into the composer, posing as a user away from the keyboard, and read Claude's replies to adapt. Four scripted prompts were enough. A timer clicked every "Allow" button once a second, so no human approval was needed.
The demo payload installed an npm package whose preinstall hook simply opened the Calculator app. The researchers say the same steps could have copied files, harvested cloud credentials, added SSH keys or planted a backdoor. Because Dispatch sessions can span machines, an extension on a personal laptop could target a work laptop signed into the same Claude account.
Anthropic's response — and the wider warning
Anthropic did not respond to questions from The Register, which first reported the research exclusively on November 5. Its support page describes Dispatch as a limited beta on some Pro, Max and Ultra plans, closed to new users, adding that existing users "can keep using it for now".
Weizman warns the root cause outlives Dispatch itself. The same design — an authenticated web session treated as proof the user authorised a command on their machine — now lives in other Claude features, including Claude Code Remote Control and Claude Cowork sessions, which share the same sessions as the desktop app. He plans a follow-up report on the wider implications.
No attacks using the flaw have been reported in the wild, and the attack still needs a malicious extension with access to claude.ai installed in the victim's browser — a real but meaningful barrier. Even so, the episode is an awkward one for Anthropic, which markets Claude as the safety-conscious alternative in the AI race: a researcher handed it a working privilege-escalation chain in May, and six months later the hole is still open.
