[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Context & Harness Attacks · markdown

confirmed research (Forever Security / Gal Weizman, Nov 4); Anthropic acknowledged as valid; Dispatch marked not available to new users / retirement planned; no CVE

Forever Security: a browser extension on claude.ai can drive Claude Dispatch to run code on Claude Desktop — including on another machine signed into the same account

  • Blast radius: same-machine = browser sandbox escape into the OS agent; cross-machine = remote code execution on any Desktop signed into that account; personal Claude on a work laptop turns a home-browser extension into an org foothold.
  • Why it matters beyond Dispatch: Forever Security argues the same trust model ("an authenticated web session may drive a local agent") shows up in Claude Code Remote Control and Cowork sessions, so retiring one feature does not close the design issue.
  • Defender takeaways: inventory Claude Desktop + Dispatch/Cowork usage; prefer corporate accounts over personal ones on managed endpoints; treat browser-extension allowlists as part of AI-agent governance; watch for unexpected Desktop tool use after web sessions.
  • Status: research PoC, no reported mass exploitation; no CVE assigned.

Sources: Forever Security: ThisBash Escape — Claude Dispatch browser-extension RCE (Nov 4) · The Hacker News summary