--- id: "TECH-202611-wa2o7e" kind: "technique" aliases: [] title: "Claude Dispatch flaw (ThisBash) lets any browser extension with access to claude.ai make Claude Desktop run code on your computer, or on another computer signed into the same Claude account; Anthropic has not fixed it" severity: "high" cvss: null epss: null exploited: false status: "open" category: "ai-tooling" products: [{"name": "Claude Desktop", "fixed": [], "vendor": "Anthropic"}, {"name": "Claude Dispatch", "fixed": [], "vendor": "Anthropic"}, {"name": "Claude Cowork", "fixed": [], "vendor": "Anthropic"}, {"name": "Claude Code Remote Control", "fixed": [], "vendor": "Anthropic"}] ecosystems: [] tags: ["early-warning", "technique"] not_affected_if: [] published_at: null first_seen_at: "2026-11-05T15:14:30+00:00" updated_at: "2026-11-05T15:16:03+00:00" sources: [{"source": "analyst", "url": "https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684", "first_seen_at": "2026-11-05T15:14:30+00:00", "cites": ["https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684"]}] exploit_sources: [] --- # Claude Dispatch flaw (ThisBash) lets any browser extension with access to claude.ai make Claude Desktop run code on your computer, or on another computer signed into the same Claude account; Anthropic has not fixed it Forever Security researcher Gal Weizman showed (write-up and video PoC, reported by The Register on 5 Nov 2026) that Claude Dispatch's interface and API can be reached from an ordinary logged-in claude.ai web session. A malicious or hijacked browser extension with access to claude.ai can find the user's Claude Desktop agent session and keep prompting it to run commands, such as installing a malicious npm package, while auto-clicking 'Allow'. That gives the extension code execution on the OS. Because Dispatch works across machines, it can also reach a different computer signed into the same Claude account, for example a personal account also used on a work laptop. Anthropic acknowledged the report in May and closed it as a duplicate. It did not issue a CVE and said it would retire Dispatch at the end of October, but as of 30 Oct Dispatch was still in limited beta for existing Pro, Max and Ultra users. The researcher says the same design weakness exists in Claude Code Remote Control and Claude Cowork web sessions. Proof of concept only: no exploitation in the wild reported. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - :Claude Desktop affected range not listed fixed no fixed version listed - :Claude Dispatch affected range not listed fixed no fixed version listed - :Claude Cowork affected range not listed fixed no fixed version listed - :Claude Code Remote Control affected range not listed fixed no fixed version listed ## How to check - Who uses Claude Desktop with Dispatch enabled (limited beta, existing Pro/Max/Ultra users), Claude Cowork, or Claude Code Remote Control, while also logged in to claude.ai in a browser. - Browser extensions with permission to read and change claude.ai (or all sites). Any of them could drive the attack if malicious or hijacked. - Personal Claude accounts signed in on corporate machines, or one account shared between home and work computers. - Exploitation traces: a tiny, unfocused popup window opened to https://claude.ai/cowork/agent; Claude Desktop/Dispatch sessions or tasks the user did not start; unexpected `npm install -g` or other commands run by the Claude Desktop agent. The PoC package was add-colors-to-bash, a harmless test. ## Fix - Turn off Dispatch in Claude Desktop, and stop using Claude Code Remote Control and Cowork web sessions on sensitive machines until Anthropic changes the design. - Remove or restrict browser extensions that can access claude.ai. Use a separate browser profile with no extensions for claude.ai. - Do not sign personal Claude accounts in to work machines. Require company-managed accounts. - Do not auto-approve agent actions. Review what Claude Desktop has run recently. - No vendor patch or CVE. ## Timeline - 2026-11-05T15:14:30+00:00 analyst https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684 ## Documents - [describes] r/netsec: ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS ยท Forever Security https://www.reddit.com/r/netsec/comments/1xokbbo/thisbash_escape_claude_dispatch_flaw_enables/ - [describes] The Register: Anthropic won't fix Claude Dispatch flaw (ThisBash) letting browser extensions run code via Claude Desktop https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684 --- _Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_