Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries

Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries

From EOP to RCE in six simple steps

Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers

A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test. The attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The flaw that makes this possible can still be exploited, the researchers said earlier this

Claude Dispatch Flaw Lets Malicious Browser Extensions Run Code on Connected Computers

A flaw in Anthropic’s Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop. That computer could even be a different machine signed into the same Claude account. Researcher Gal Weizman of Forever Security named the technique ThisBash and published the findings on November 4, 2026. Anthropic plans to retire […]

Anthropic won’t fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries

Jessica Lyons reports: A vulnerability in Anthropic’s Claude products lets any browser extension that can control Claude Dispatch make Claude Desktop run code on the computer – or even a different machine signed into the same Claude account – with no browser exploit and minimal user interaction required. Anthropic, aware of the problem since May,...