A flaw in Anthropic's Claude Dispatch feature could let a malicious browser extension run commands on a person's computer through the Claude Desktop app, researchers have shown. The attack, named ThisBash by researcher Gal Weizman of Forever Security, was published on 4 November 2026.

How the attack works

Dispatch lets people send tasks from a phone to Claude Desktop, an AI agent that can run commands and work with local files. The researchers found Dispatch also accepted requests from an ordinary signed-in session on claude.ai, even though the website showed no link to it. A browser extension able to run scripts on claude.ai could therefore send instructions to Claude Desktop as if the user had typed them. In the test, a script sent four prompts, clicked every "Allow" button once a second, and got Claude to install a package whose install script opened the Calculator app.

No real attacks reported

The researchers say they have seen no real attacks using the flaw, and the test ran with the browser and Claude Desktop on the same computer. But because Dispatch connects devices, they say an extension could also reach Claude Desktop on a different computer signed into the same Claude account, linking a home computer to a work laptop.

Anthropic's response

Weizman reported the issue to Anthropic on 14 May. The company accepted it as valid on 19 May but closed it as a duplicate of a problem it had already found. On 13 October it said Dispatch would be retired by the end of October, but the researchers say the feature's help page still does not mention a retirement, and the same design lives on in Claude Code Remote Control and Cowork sessions.