---
title: ThisBash: a browser extension that can script claude.ai could drive Claude Desktop through Dispatch and run code on the computer | ctxsec
url: https://ctxsec.com/items/thisbash-claude-dispatch-browser-extension-desktop-code-execution
description: "Forever Security researcher Gal Weizman found that Claude Dispatch, which sends tasks from a phone or browser to Claude Desktop, also accepted an ordinary signed-in claude.ai session. In a test, an extension script on claude.ai opened Dispatch, sent four prompts as the user, auto-clicked the Allow buttons, and got Claude Desktop to globally install an npm package whose install script opened Calculator. Because Dispatch links devices, the same reach could extend to another computer signed into the same Claude account. The researchers reported it May 14; they say Anthropic accepted it as a duplicate and told them on Oct 13 that Dispatch would be retired, and that Claude Code Remote Control and Cowork sessions share the same web-drives-local-agent design (not tested in their write-up)."
status: "vendor research (Forever Security, Nov 4); researcher test only, no attacks in the wild reported; Anthropic acknowledged the report as valid (per the researchers) and says Dispatch is closed to new users"
published: 2026-11-07
---

> Forever Security researcher Gal Weizman found that Claude Dispatch, which sends tasks from a phone or browser to Claude Desktop, also accepted an ordinary signed-in claude.ai session. In a test, an extension script on claude.ai opened Dispatch, sent four prompts as the user, auto-clicked the Allow buttons, and got Claude Desktop to globally install an npm package whose install script opened Calculator. Because Dispatch links devices, the same reach could extend to another computer signed into the same Claude account. The researchers reported it May 14; they say Anthropic accepted it as a duplicate and told them on Oct 13 that Dispatch would be retired, and that Claude Code Remote Control and Cowork sessions share the same web-drives-local-agent design (not tested in their write-up).

[← Context & Harness Attacks](/context) · [markdown](/items/thisbash-claude-dispatch-browser-extension-desktop-code-execution.md)

vendor research (Forever Security, Nov 4); researcher test only, no attacks in the wild reported; Anthropic acknowledged the report as valid (per the researchers) and says Dispatch is closed to new users

2026-11-07

### ThisBash: a browser extension that can script claude.ai could drive Claude Desktop through Dispatch and run code on the computer

- **Preconditions:** an extension (malicious, compromised by an update, or buggy) that can run scripts on claude.ai, and a user signed in to claude.ai and Claude Desktop with Dispatch on and the desktop app open.
- **Why approvals didn't help:** the approval prompts showed in the web page the extension controlled, so the script clicked Allow every second.
- **Do now:** turn off cross-device Dispatch if you don't need it; keep personal Claude accounts with Dispatch off work machines; restrict which extensions may run on claude.ai; watch agents for unexpected package installs and new outbound connections.

Sources: [Forever Security: ThisBash Escape, Claude Dispatch flaw enables browser extension RCE on the OS (Nov 4)](https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce) · [The Hacker News: malicious browser extensions could use Claude Dispatch to run code (Nov 6)](https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html) · [The Register: Anthropic won't fix a Claude Dispatch flaw (Nov 5)](https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684)