Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries

Anthropic’s Claude may be the darling of the AI hype train, but the latest “design choice” flaw uncovered by Forever Security researcher Gal Weizman shows why founders need to treat these shiny new features like a loaded cannon—dangerous if mis‑aimed. The vulnerability, dubbed ThisBash, lets any browser extension that can touch the Claude web UI hijack the Dispatch feature and run arbitrary code on the user’s desktop—or even on a second machine tied to the same Claude account—without a classic browser exploit. Anthropic has known about the issue since May, yet it has done nothing to seal the hole, opting instead to promise a retirement that never materialised. For anyone running independent hosting or SaaS platforms, this is a stark reminder: “best practice” from a VC‑backed AI vendor often collapses the moment you put it in production.

Why the Dispatch design is a perfect storm

Dispatch was built to let users send tasks from a phone or browser to Claude Desktop, an AI agent that can execute commands on the local OS. In theory, that cross‑device convenience is brilliant, but in practice it smashes the traditional web‑browser security boundary. Weizman showed that the Dispatch API is reachable from a normal logged‑in session at claude.ai. A malicious extension can therefore issue the same API calls a legitimate mobile client would, tricking the desktop agent into running anything it wants.

The attack chain is disturbingly simple: a content script runs in the main world of the Claude web page, grabs the user’s session cookies, opens a tiny hidden popup to the Dispatch endpoint, pulls the desktop session ID, and then pumps prompts that coax Claude into installing a malicious npm package or executing arbitrary shell commands. Because Claude prompts the user for approval, the script simply clicks “Allow” every second, automating the consent loop. The result is remote code execution (RCE) with the same privileges as the logged‑in user—potentially full admin on a corporate laptop.

The real‑world blast radius

Claude.ai logged roughly 950 million monthly visits by mid‑2026, and its Cowork feature recorded 1.2 million sampled sessions from over 600 000 organisations. That translates to a massive attack surface: any employee using Claude on a browser, whether on a personal or corporate device, becomes a foothold. The research notes that personal Claude accounts appear in corporate environments at rates ranging from 18 % to 71 % across a handful of organisations. In one case, 255 of 1 233 known accounts were personal. When a user shares an account across home and work machines, Dispatch can become a bridge from a compromised personal browser to a corporate desktop, enabling lateral movement that bypasses typical network segmentation.

The danger isn’t limited to the same machine. Dispatch was designed to work across devices, meaning a malicious browser session could command a Claude Desktop agent on a completely different computer, provided both are logged into the same Claude account. In a corporate setting where employees use the same account on a personal laptop and a work laptop, an attacker could infiltrate the corporate endpoint from a compromised personal device—a classic supply‑chain pivot that traditional endpoint security often misses.

Anthropic’s response (or lack thereof)

Anthropic acknowledged the report in May, but classified the issue as a duplicate of an existing flaw and declined to issue a CVE or pay a bounty. Their public stance was to retire Dispatch by the end of October. Yet, as of October 30, the feature remained in limited beta on Pro, Max and Ultra plans, with a note that existing users could continue using it. No clear timeline for a full shutdown was given, and the company has been silent on follow‑up questions. This half‑hearted approach leaves millions of installations exposed, and the underlying design flaw persists in other features like Claude Code Remote Control and Claude Cowork sessions.

From a founder’s perspective, this is a textbook case of a vendor putting product roadmaps ahead of security. The hype around “AI‑driven productivity” masks a fundamental breach of the web’s same‑origin policy. When a vendor’s “best practice” ignores the established threat model, you as a customer must assume the risk and plan mitigations yourself.

Design lessons: treat web and desktop as separate security zones

Weizman suggested a pragmatic fix: treat the web client as a lower‑privilege device and block it from issuing commands that affect the desktop. In practice, that means enforcing a strict permission model where only trusted native clients can invoke Dispatch actions, while the browser is limited to read‑only queries. OpenAI’s Codex already follows this approach—its web version cannot access sessions started on a desktop, effectively eliminating the attack vector.

Implementing such a separation is not a lofty research problem; it’s a design decision. By refusing to segregate the web and desktop contexts, Anthropic essentially handed attackers a “back door” that bypasses the browser sandbox. Independent hosting providers should demand similar segregation from any AI‑orchestrated tooling they integrate, or else risk inheriting the same exposure.

What this means for independent hosting and SaaS operators

If you run a hosting platform that lets customers install browser extensions or embed third‑party web UIs, you now have a concrete example of how a seemingly innocuous extension can become a full‑blown RCE vector. The chain relies on three ingredients: a malicious extension, an authenticated Claude session, and Dispatch enabled. Any environment where users can install extensions—whether corporate laptops, BYOD policies, or even shared workstations—must treat that as a high‑risk zone.

From a risk‑management standpoint, you should audit any integration that bridges a web session to a local agent. Look for APIs that expose session IDs or allow command execution without multi‑factor confirmation. If you cannot enforce a strict permission boundary, consider disabling the feature entirely or sandboxing the desktop agent in a container with minimal privileges.

Actionable steps for founders and security teams

First, inventory all tools that permit cross‑device command execution. If Claude Dispatch or similar features are in use, enforce MFA for every session and disable the feature for any accounts that also access corporate resources. Second, implement extension control policies: block installation of unsigned extensions, monitor for sudden spikes in extension activity, and use endpoint detection and response (EDR) solutions to flag attempts to launch external processes from browsers.

Third, demand transparency from vendors. Anthropic’s silence and reliance on a vague “beta” label should be a red flag. Push for CVE assignments, bug bounty eligibility, and clear deprecation timelines. Finally, consider alternative AI agents that respect the web‑desktop security divide, such as OpenAI’s Codex, which isolates sessions by design.

Bottom line: hype is cheap, security is expensive

The Claude Dispatch flaw is a textbook example of how a “productivity” feature can become a massive attack surface when the underlying security model is ignored. Anthropic’s inaction after being warned in May underscores a broader industry problem: VC‑funded AI startups often prioritize rapid feature roll‑outs over robust threat modeling. For independent hosting providers and founders, the lesson is clear—don’t let the allure of AI‑driven convenience blind you to the fundamentals of security.

Stay vigilant, demand proper isolation between web and desktop contexts, and lock down any extension pathways before they become the next vector that lets attackers run code on your customers’ machines. The cost of a breach far outweighs the effort of a disciplined security design.

— Allan Ali, Founder

This article was produced with AI-assisted research and editorial support. Reporting is based on the source material cited below. Sources: The Register; theregister.com; Global1.News (07 November 2026).

By Allan Ali, Global1.News