Anthropic leaves Claude Dispatch flaw unpatched, risking remote code attacks

How the flaw works

A flaw in Anthropic's Claude Dispatch feature could let attackers run remote commands on users' computers. According to security researcher Gal Weizman, the problem starts with Claude Dispatch, a tool that lets users send tasks from their browser or phone to Claude Desktop, an AI agent that executes commands on their machine. The flaw allows any browser extension with access to claude.ai to send commands to Claude Desktop as if they came from the user. This means an attacker could use a malicious or hijacked browser extension to compromise a computer with minimal user interaction, without needing to exploit the browser itself.

Weizman demonstrated that the extension could escalate its privileges, giving it full access to the operating system. In his proof-of-concept, the attack chain included opening a hidden Dispatch window, using the user's session cookies to identify the desktop agent, and sending prompts that trick Claude into running code. The attacker could automate clicks to approve any prompts, making the process nearly invisible. The final payload could be anything from opening a calculator to installing malware or stealing credentials.

Who is affected

Claude.ai had about 950 million monthly visits as of mid-2026, and the Cowork feature saw 1.2 million sampled sessions from over 600,000 organisations in May, based on Anthropic's own data. The Dispatch feature is available in limited beta to some Pro, Max, and Ultra plan users, but not to new users. However, Weizman warns that similar weaknesses exist in other Claude features, such as Code Remote Control and Cowork sessions, so the risk may extend beyond just Dispatch users.

The response

Weizman reported the flaw (dubbed "ThisBash") to Anthropic in May. The company acknowledged it as a valid vulnerability but closed the report as a duplicate of a known issue. Anthropic did not issue a CVE or pay a bug bounty. Instead, it told Weizman it planned to retire the Dispatch feature by the end of October. As of 30 October, Dispatch was still listed as available in limited beta, and existing users could continue to use it. Anthropic did not respond to further questions from The Register about the timeline or whether the underlying design flaw would be fixed. Weizman argues that the core weakness remains in other Claude features.

How the attack worked

The attack requires a browser extension with access to claude.ai, which could be installed by tricking a user or by hijacking a legitimate extension. Once present, the extension can interact with Claude Desktop via Dispatch or similar features. The attack chain involves:

• Opening a hidden Dispatch session
• Using session cookies to identify the desktop agent
• Sending crafted prompts to make Claude run commands
• Automating approval clicks to bypass user confirmation

Weizman notes that attackers often hijack legitimate extensions through supply-chain attacks or by buying them on the black market. The attack is described as "when, not if" if a malicious extension is present.

What you should do

Users should be cautious about installing browser extensions, especially those that request access to claude.ai or similar services. Organisations using Claude Desktop or related features should review their extension policies and consider limiting or monitoring browser extension use. Anthropic users should watch for updates about the retirement of Dispatch and any changes to related features.

Only The Register has reported this flaw so far, and Anthropic has not publicly confirmed the details or responded to questions about future fixes. The full impact on other Claude features is not yet clear.