A browser extension able to run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, have shown in a test. The attack, which the researchers call ThisBash, needs no browser exploit and, they say, can still be carried out.

The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. Claude Desktop is an AI agent that can run commands on the computer where it is installed. The researchers found that Dispatch also accepted an ordinary signed-in session on claude.ai, the Claude website, even though the site showed no link to it. That let an extension running on the site send Claude Desktop instructions as if the user had sent them.

In the test, a script on the user's claude.ai page opened Dispatch and sent Claude four prompts as if they came from the user. The prompts asked Claude to install an npm package. Claude first hesitated over the unfamiliar package, but a follow-up message, delivered in the user's voice, got it to go ahead. Claude asks before it acts, but those approval prompts appeared in the web page the extension controlled, and the script clicked any "Allow" button every second, so no one had to be watching.

Claude then ran a global npm install, and the package's install script opened the Calculator app. The researchers say the same step could have stolen files or installed a backdoor, given Claude's permissions on the computer. The extension could be malicious, a legitimate one that received a compromised update, or a legitimate one with a security flaw. Dispatch only works while the computer is awake and the desktop app is open.

Because Dispatch connects devices, the extension could also reach Claude Desktop on a different computer signed in to the same Claude account, the researchers say. That case is described but was not shown in the test. The same reach could link a home computer to a work laptop when someone uses a single personal Claude account on both devices, with Dispatch turned on. The researchers say they have seen personal Claude accounts with cross-device Dispatch turned on at their customers' workplaces. No real attacks have been reported.

The researchers reported the flaw to Anthropic, the company that makes Claude, on 14 May. The company accepted it as valid on 19 May but closed the report as a duplicate of an issue it had already found internally, according to the researchers. Anthropic told them on 13 October that Dispatch would be retired, with the end of October as the target. The Dispatch help page, last updated late last week, does not mention a retirement. It says Dispatch is closed to new users and that people who already use it on some Pro, Max and Ultra plans "can keep using it for now."

The researchers warn that retiring Dispatch does not fix the underlying design. They say two other Claude features, Claude Code Remote Control and Claude Cowork sessions, let extensions carry out the same attack, although their write-up does not include a test of those features and they plan a follow-up post. The core problem, as they put it, is that an authenticated web session is not, by itself, evidence that the user authorised a command on their machine.

For users, the researchers recommend turning off cross-device Dispatch if it is not needed, and reviewing how devices are paired, approved and removed if it is. Browser extensions should be treated like other software on the computer: check their permissions, control what gets installed, and review updates that give them more access. It is also worth watching what AI agents do on the computer, including unexpected package installations, setting changes, access to credentials and external connections.