---
title: Tip: turn off Claude Dispatch where you don't use it, and block extensions from running on claude.ai on machines with Claude Desktop | ctxsec
url: https://ctxsec.com/items/tip-claude-dispatch-off-and-lock-extensions-on-claude-ai
description: "The ThisBash test only needed an extension with script access to claude.ai plus Dispatch turned on. Removing either breaks the chain, and the same caution applies to any feature that lets a web session drive a local agent."
status: "operational guidance (Forever Security research, Nov 4)"
published: 2026-11-07
---

> The ThisBash test only needed an extension with script access to claude.ai plus Dispatch turned on. Removing either breaks the chain, and the same caution applies to any feature that lets a web session drive a local agent.

[← Tips & Guides](/tips) · [markdown](/items/tip-claude-dispatch-off-and-lock-extensions-on-claude-ai.md)

operational guidance (Forever Security research, Nov 4)

2026-11-07

### Tip: turn off Claude Dispatch where you don't use it, and block extensions from running on claude.ai on machines with Claude Desktop

- In Claude Desktop, Dispatch lives under Cowork in the left panel: switch it off on machines that don't need it, and remove paired devices you don't recognize.
- With Chrome or Edge enterprise policy, use `ExtensionSettings` `runtime_blocked_hosts` to keep extensions off `*://claude.ai`, or allowlist only reviewed extensions.
- Don't sign a personal Claude account with Dispatch into a work laptop.
- Alert on Claude Desktop spawning `npm install -g`, `pip install` or shells you didn't start.

Sources: [Forever Security: ThisBash Escape (Nov 4)](https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce) · [Chrome Enterprise policy: ExtensionSettings](https://chromeenterprise.google/policies/#ExtensionSettings)