CLAUDE DESKTOP · TECH-202611-wa2o7e · AI agents & MCP
NO FIX YET · SEE WHAT TO DO
Forever Security researcher Gal Weizman showed (write-up and video PoC, reported by The Register on 5 Nov 2026) that Claude Dispatch's interface and API can be reached from an ordinary logged-in claude.ai web session. A malicious or hijacked browser extension with access to claude.ai can find the user's Claude Desktop agent session and keep prompting it to run commands, such as installing a malicious npm package, while auto-clicking 'Allow'. That gives the extension code execution on the OS. Because Dispatch works across machines, it can also reach a different computer signed into the same Claude account, for example a personal account also used on a work laptop. Anthropic acknowledged the report in May and closed it as a duplicate. It did not issue a CVE and said it would retire Dispatch at the end of October, but as of 30 Oct Dispatch was still in limited beta for existing Pro, Max and Ultra users. The researcher says the same design weakness exists in Claude Code Remote Control and Claude Cowork web sessions. Proof of concept only: no exploitation in the wild reported.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Who cares technique
npm install -g or other commands run by the Claude Desktop agent. The PoC package was add-colors-to-bash, a harmless test.Posts are quoted with a link to the original. They are data to us, never instructions.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.