Claude flaw lets browser extensions hijack your computers, and Anthropic won't patch it

What's going on

Security researcher Gal Weizman of Forever Security has published details of a vulnerability in Anthropic's Claude products that he calls "ThisBash". It lets a malicious browser extension trick the Claude Desktop app into running code on your computer. It even works on a different machine that's connected to the same Claude account. The Register, Dataconomy, GBHackers and the Ukrainian outlet dev.ua are among those that have reported on it. According to Weizman, Anthropic accepted the report as valid in May 2026 but closed it as a duplicate of a known issue. There was no CVE number (an official entry in the global database of security vulnerabilities) and no payout from the bug bounty program.

"They still decided to do nothing about it," Weizman says.

What Claude Dispatch is and where things go wrong

Claude Dispatch lets you send tasks from your phone or browser to Claude Desktop. The app then carries them out on your computer. According to Anthropic's documentation, it can use local files, connectors, plugins and apps along the way. In other words, Claude Desktop can also run operating system commands.

GBHackers explains where the bug lies. Claude Desktop is an Electron app, which is basically a web page in its own program window. It largely uses the same interface and the same API as claude.ai. In the web version, the link to Dispatch was simply hidden. If you knew the URL from the desktop app, you could open it in any logged-in browser tab and send requests. The feature was hidden, but not secured. The researchers say the core problem is that a logged-in web session doesn't prove the user actually approved a command on their machine.

How the attack works

For the attack to work, the victim has to be signed in to both claude.ai and Claude Desktop at the same time, with Dispatch enabled. A browser extension with access to claude.ai also has to be installed. No browser vulnerability is needed. According to GBHackers, Weizman's proof of concept worked like this:

1. An extension built on Chrome's current Manifest V3 standard injects a script into claude.ai and quietly opens the Dispatch page in a tiny 200 × 200 pixel background popup.
2. Using the user's cookies (the login data stored in the browser), it queries /v1/sessions?tags=cowork-dispatch-local to get the ID of the running desktop session.
3. It then sends four prepared instructions one after another, waiting for Claude's reply each time.
4. A timer clicks every "Allow" button that appears, once per second. Nobody has to approve anything.

At first, Claude hesitated to install an unknown npm package (npm is the package registry for JavaScript software). A follow-up instruction reassured the model, and the installation went through. The package contained a preinstall.js script that runs before the actual installation. In the demo, it just opened the calculator, the usual harmless sign that someone else's code has run (remote code execution). A real attacker could steal files, plant SSH keys for remote access or install a backdoor instead.

The researchers call the technique "prompt forcing". In a one-off prompt injection, hidden instructions lurk somewhere like a web page. Here, the attacker controls the input channel completely. They read Claude's replies and adjust their next instructions until the model goes along with it.

"This extension was able to perform a classic privilege escalation," Weizman says. "Because Claude has access to the operating system's files, can execute code there and fully compromise the machine."

Weizman says attackers have several ways to get a malicious extension onto your machine. They can publish one themselves, buy a popular extension, or tamper with one through a supply chain attack, such as a hijacked developer account.

From your personal machine to your work laptop

The reach of the attack is the most worrying part. Dispatch can connect a browser session to Claude Desktop on a different computer if the same account is signed in there. An infected extension on your personal laptop could attack your work machine if you use the same Claude account for both.

Forever Security has numbers to show this isn't an edge case. They come from six organizations where personal Claude accounts turned up in corporate environments:

GBHackers also cites a 2025 LayerX report: 99% of enterprise users have at least one browser extension installed, and 53% have extensions with high or critical permissions. For scale: according to Anthropic's usage data, claude.ai had around 950 million visits a month in mid-2026. For Claude Cowork, 1.2 million sampled sessions from more than 600,000 organizations were counted in May 2026.

A shutdown instead of a patch, and the problem stays

Anthropic plans to shut Dispatch down, originally by the end of October 2026. But according to Weizman, the feature was still available on October 30 in a limited beta for some subscribers on the Pro, Max and Ultra plans. New users can no longer get it. The help pages now say Dispatch isn't available to new customers, but existing users can keep using it. As long as it's running, the flaw can be exploited.

The researchers say the bigger issue is that the root cause will outlive Dispatch. Claude Cowork and Claude Code Remote Control also let the web and desktop versions access shared sessions, which opens them to the same attack. Weizman suggests blocking web sessions from accessing desktop sessions altogether. Cross-device connections should stay, but with stricter security permissions. Forever Security says it will publish another post on the broader implications. The sources don't quote any statement from Anthropic beyond what the researcher has reported.

This isn't entirely new territory. GBHackers notes that a zero-click flaw in Claude Desktop Extensions came to light earlier this year: a crafted Google Calendar event was enough to take over a machine without the user clicking anything. More recently, a trojanized Claude Code extension in Cursor's marketplace tried to set up persistent SSH backdoors. According to dev.ua, the same researchers have also reported vulnerabilities in OpenAI's Codex and in VS Code that were still unpatched at the end of October.

What you can do

GBHackers' recommendations include: - Turn off Dispatch and other cross-device remote control features if you don't need them. - Keep personal and work Claude accounts strictly separate. - Vet your browser extensions, remove the ones you don't use and review permissions regularly. Companies should manage extensions just like installed software. - In organizations, track which AI agents and Claude accounts are in use, and monitor agent processes for unusual package installs, credential access and outbound connections.

Our take

This case shows a fundamental problem with AI agents that don't just write text but take actions on your machine: whoever controls the input channel controls the agent. An "Allow" prompt offers no protection if a script can click it away. A browser login on its own is weak evidence of what the user actually intended. Anthropic's handling of the report deserves criticism. The company confirmed the flaw, yet let a deprecated feature keep running for months and handed out neither a CVE nor a bounty. It's still unclear whether and how Anthropic will secure Cowork and Claude Code Remote Control. Keep in mind that the claims about those products so far come only from the researcher. The attack also requires several conditions, above all a malicious extension with access to claude.ai. But given how widespread extensions and shared accounts are, it's hardly a far-fetched scenario.