Browser extensions can abuse Claude Dispatch to run desktop commands

Researchers at endpoint security company Forever Security demonstrated that a browser extension able to run scripts on claude.ai could send instructions through Claude Dispatch and cause Claude Desktop to execute commands on a user’s computer. In the proof of concept, Claude installed an npm package whose installation script opened the Calculator application.

The attack requires a user to be signed in to both claude.ai and Claude Desktop, with Dispatch enabled. Claude Desktop also has to be open and the computer awake. Forever Security said it had not observed real-world attacks, but said the underlying flaw remained exploitable when it published its findings.

Web session accepted by a desktop-control feature

Dispatch is designed to send tasks from a phone to Claude Desktop, an AI agent that can run commands on the computer where it is installed. Forever Security researcher Gal Weizman found that Dispatch accepted a normal authenticated claude.ai web session even though the site presented no visible Dispatch link. An extension executing on that site could therefore issue instructions that appeared to come from the signed-in user.

The extension could be malicious, a legitimate extension compromised through an update, or software with its own security flaw. The demonstrated chain did not depend on a browser vulnerability. It depended on the extension’s ability to manipulate the claude.ai page and the user’s existing session.

Approvals can be handled in the controlled page

In the test, a script opened Dispatch and supplied four prompts. Claude initially expressed concern about an unfamiliar package, but a subsequent prompt presented as the user persuaded it to continue. Claude requested approval before acting, yet those approval dialogs appeared in the browser page under the extension’s control.

The script clicked an Allow button every second, leaving no need for the user to be watching. Claude then performed a global npm installation, and the package’s install script launched Calculator. Forever Security said a comparable action could steal files or install a backdoor if Claude had the necessary permissions.

The finding adds a browser-to-endpoint dimension to agent security: AI systems in an attack chain illustrates how AI systems can become part of an attack chain when trust boundaries and tool permissions are combined. Forever Security also said Claude Code Remote Control and Claude Cowork sessions could permit a similar extension-driven path, although its published write-up did not test those features.

Dispatch retirement does not remove the immediate exposure

Forever Security reported the issue to Anthropic on May 14. Anthropic accepted it as valid on May 19, then closed the report as a duplicate of an internally identified issue, the researchers said. The researchers said Anthropic told them on October 13 that Dispatch would be retired, targeting the end of October.

However, a Dispatch help page updated late last week stated that the feature was closed to new users while existing users on certain Pro, Max and Ultra plans could continue using it for now. It also advised users to understand how to disconnect or revoke access, without explaining the process.

Organizations using Claude Desktop should turn off cross-device Dispatch where it is not needed, review paired devices and removal controls where it is needed, and scrutinize browser-extension permissions and updates. They should also monitor agent activity for unexpected package installations, configuration changes, credential access and external connections.