{"id":"TECH-202611-wa2o7e","kind":"technique","aliases":[],"related":[],"title":"Claude Dispatch flaw (ThisBash) lets any browser extension with access to claude.ai make Claude Desktop run code on your computer, or on another computer signed into the same Claude account; Anthropic has not fixed it","description":null,"summary":"Forever Security researcher Gal Weizman showed (write-up and video PoC, reported by The Register on 5 Nov 2026) that Claude Dispatch's interface and API can be reached from an ordinary logged-in claude.ai web session. A malicious or hijacked browser extension with access to claude.ai can find the user's Claude Desktop agent session and keep prompting it to run commands, such as installing a malicious npm package, while auto-clicking 'Allow'. That gives the extension code execution on the OS. Because Dispatch works across machines, it can also reach a different computer signed into the same Claude account, for example a personal account also used on a work laptop. Anthropic acknowledged the report in May and closed it as a duplicate. It did not issue a CVE and said it would retire Dispatch at the end of October, but as of 30 Oct Dispatch was still in limited beta for existing Pro, Max and Ultra users. The researcher says the same design weakness exists in Claude Code Remote Control and Claude Cowork web sessions. Proof of concept only: no exploitation in the wild reported.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Claude Desktop","fixed":[],"vendor":"Anthropic"},{"name":"Claude Dispatch","fixed":[],"vendor":"Anthropic"},{"name":"Claude Cowork","fixed":[],"vendor":"Anthropic"},{"name":"Claude Code Remote Control","fixed":[],"vendor":"Anthropic"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"- Who uses Claude Desktop with Dispatch enabled (limited beta, existing Pro/Max/Ultra users), Claude Cowork, or Claude Code Remote Control, while also logged in to claude.ai in a browser.\n- Browser extensions with permission to read and change claude.ai (or all sites). Any of them could drive the attack if malicious or hijacked.\n- Personal Claude accounts signed in on corporate machines, or one account shared between home and work computers.\n- Exploitation traces: a tiny, unfocused popup window opened to https://claude.ai/cowork/agent; Claude Desktop/Dispatch sessions or tasks the user did not start; unexpected `npm install -g` or other commands run by the Claude Desktop agent. The PoC package was add-colors-to-bash, a harmless test.","fix":"- Turn off Dispatch in Claude Desktop, and stop using Claude Code Remote Control and Cowork web sessions on sensitive machines until Anthropic changes the design.\n- Remove or restrict browser extensions that can access claude.ai. Use a separate browser profile with no extensions for claude.ai.\n- Do not sign personal Claude accounts in to work machines. Require company-managed accounts.\n- Do not auto-approve agent actions. Review what Claude Desktop has run recently.\n- No vendor patch or CVE.","status":"open","published_at":null,"first_seen_at":"2026-11-05T15:14:30+00:00","triaged_at":"2026-11-05T15:14:30+00:00","updated_at":"2026-11-05T15:16:03+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':36A '2026':72B '30':200B '5':70B 'access':10A,99B 'account':30A,156B,161B 'acknowledg':169B 'across':142B 'agent':109B 'allow':129B 'also':146B,162B 'anoth':23A 'anthrop':31A,168B 'api':79B 'auto':127B 'auto-click':126B 'beta':207B 'browser':7A,96B 'claud':1A,14A,29A,74B,107B,155B,224B,229B 'claude':39A,41A,43A,45A 'claude.ai':12A,89B,101B 'click':128B 'close':175B 'code':17A,46A,134B,225B 'command':117B 'comput':20A,24A,150B 'concept':235B 'control':48A,227B 'cowork':44A,230B 'cve':185B 'design':220B 'desktop':15A,40A,108B 'differ':149B 'dispatch':2A,42A,75B,140B,191B,202B 'duplic':179B 'earli':50B 'early-warn':49B 'end':194B 'exampl':158B 'execut':135B 'exist':209B,222B 'exploit':238B 'extens':8A,97B,133B 'find':103B 'fix':34A 'flaw':3A 'forev':53B 'gal':56B 'give':131B 'hijack':95B 'instal':120B 'interfac':77B 'issu':183B 'keep':112B 'laptop':167B 'let':5A 'limit':206B 'log':87B 'logged-in':86B 'machin':143B 'make':13A 'malici':93B,122B 'max':211B 'may':173B 'nov':71B 'npm':123B 'oct':201B 'octob':196B 'ordinari':85B 'os':138B 'packag':124B 'person':160B 'poc':64B 'pro':210B 'prompt':113B 'proof':233B 'reach':82B,147B 'regist':68B 'remot':226B 'remote':47A 'report':65B,171B,242B 'research':55B,216B 'retir':190B 'run':16A,116B 'said':187B 'say':217B 'secur':54B 'session':91B,110B,232B 'show':58B 'sign':25A,151B 'still':204B 'tech':35A 'techniqu':52B 'thisbash':4A,38A 'ultra':213B 'use':163B 'user':105B,214B 'video':63B 'wa2o7e':37A 'warn':51B 'weak':221B 'web':90B,231B 'weizman':57B 'wild':241B 'work':141B,166B 'would':189B 'write':60B 'write-up':59B","nicknames":["ThisBash"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["claudecoderemotecontrol","claudecowork","claudedesktop","claudedispatch","coderemotecontrol","cowork","desktop","dispatch","thisbash"],"ptokens":["claude","code","control","cowork","desktop","dispatch","remote"],"labels":["aitooling","earlywarning","high","technique"],"campaign_type":"exploitation","first_public_at":"2026-11-05T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-wa2o7e","url":"https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-05T15:14:30+00:00","fetched_at":"2026-11-05T15:14:30+00:00","note":null,"cites":["https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684"]}],"documents":[{"id":77123,"url":"https://www.reddit.com/r/netsec/comments/1xokbbo/thisbash_escape_claude_dispatch_flaw_enables/","title":"r/netsec: ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security","kind":"post","source":"reddit","publisher":null,"text":"ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS · Forever Security\n\nsubmitted by /u/Content-Winter5328 [link] [comments]","published_at":"2026-11-05T14:40:21+00:00","relation":"describes","confidence":null,"note":null},{"id":77197,"url":"https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684","title":"The Register: Anthropic won't fix Claude Dispatch flaw (ThisBash) letting browser extensions run code via Claude Desktop","kind":"blog","source":"analyst","publisher":null,"text":"Forever Security researcher Gal Weizman (ThisBash): Claude Dispatch interface/API reachable from a logged-in claude.ai web session. A browser extension with access to claude.ai registers a MAIN-world content script, opens https://claude.ai/cowork/agent in a tiny unfocused popup (only visible trace), calls GET /v1/sessions?tags=cowork-dispatch-local to get the Claude Desktop agent session, force-prompts the agent to run code (PoC: npm install -g add-colors-to-bash with preinstall hook), auto-clicks Allow every second. Works across machines signed into the same Claude account (personal account to work laptop). Anthropic acknowledged in May, closed as duplicate, no CVE, said it would retire Dispatch end of October; as of Oct 30 still in limited beta for Pro/Max/Ultra existing users. Researcher says the same weakness exists in Claude Code Remote Control and Claude Cowork web sessions. PoC only, no in-the-wild exploitation reported.","published_at":"2026-11-05T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}