---
title: Forever Security: a browser extension on claude.ai can drive Claude Dispatch to run code on Claude Desktop — including on another machine signed into the same account | ctxsec
url: https://ctxsec.com/items/claude-dispatch-thisbash-escape-browser-extension-rce
description: "Researchers at Forever Security showed that Claude Dispatch's web UI and API were reachable from an ordinary authenticated claude.ai session. An extension that can run scripts on that origin can open Dispatch, send prompts as the user, auto-click Allow dialogs, and get Claude Desktop to execute local commands (their demo installed an npm package that opened Calculator). Because Dispatch bridges devices, the same path can reach Claude Desktop on a different computer sharing the Claude login. Anthropic marked the report valid in May 2026 and has said Dispatch will be retired; as of early November the help page still lets existing users keep it."
status: "confirmed research (Forever Security / Gal Weizman, Nov 4); Anthropic acknowledged as valid; Dispatch marked not available to new users / retirement planned; no CVE"
published: 2026-11-04
---

> Researchers at Forever Security showed that Claude Dispatch's web UI and API were reachable from an ordinary authenticated claude.ai session. An extension that can run scripts on that origin can open Dispatch, send prompts as the user, auto-click Allow dialogs, and get Claude Desktop to execute local commands (their demo installed an npm package that opened Calculator). Because Dispatch bridges devices, the same path can reach Claude Desktop on a different computer sharing the Claude login. Anthropic marked the report valid in May 2026 and has said Dispatch will be retired; as of early November the help page still lets existing users keep it.

[← Context & Harness Attacks](/context) · [markdown](/items/claude-dispatch-thisbash-escape-browser-extension-rce.md)

confirmed research (Forever Security / Gal Weizman, Nov 4); Anthropic acknowledged as valid; Dispatch marked not available to new users / retirement planned; no CVE

2026-11-04

### Forever Security: a browser extension on claude.ai can drive Claude Dispatch to run code on Claude Desktop — including on another machine signed into the same account

- **Blast radius:** same-machine = browser sandbox escape into the OS agent; cross-machine = remote code execution on any Desktop signed into that account; personal Claude on a work laptop turns a home-browser extension into an org foothold.
- **Why it matters beyond Dispatch:** Forever Security argues the same trust model ("an authenticated web session may drive a local agent") shows up in Claude Code Remote Control and Cowork sessions, so retiring one feature does not close the design issue.
- **Defender takeaways:** inventory Claude Desktop + Dispatch/Cowork usage; prefer corporate accounts over personal ones on managed endpoints; treat browser-extension allowlists as part of AI-agent governance; watch for unexpected Desktop tool use after web sessions.
- **Status:** research PoC, no reported mass exploitation; no CVE assigned.

Sources: [Forever Security: ThisBash Escape — Claude Dispatch browser-extension RCE (Nov 4)](https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce) · [The Hacker News summary](https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html)