Anthropic leaves open a flaw that lets a rogue browser add-on control Claude

A security researcher says a malicious browser extension can take over Claude's desktop agent and make it run code on your computer. Anthropic has known since May and has not closed the hole. The researcher, Gal Weizman of Forever Security, says the same weakness also exists in newer Claude features, even if the one he tested is retired.

What was found

The flaw involves Claude Dispatch, a feature that lets people send tasks from a phone or browser to Claude Desktop. Claude Desktop is an AI agent that runs commands on a computer. Weizman found that Dispatch could be reached from an ordinary signed-in session at claude.ai. An extension that can control that page can send orders as if the real user had given them. He named the flaw ThisBash.

How the attack works

No browser exploit is needed, and the user does very little. Weizman's demonstration script follows a set pattern:

• It opens Dispatch in a tiny popup, the only visible sign of the attack.
• It types instructions to Claude and keeps insisting if Claude seems suspicious.
• It clicks Allow every second, so Claude's approval prompts never stall it.
• It repeats until code runs, which Weizman calls a matter of when, not if.

In the demonstration, Claude installed a malicious software package that opened the calculator app. The report says a real attack would likely be far worse, such as malware that steals source code and cloud credentials, or a hidden backdoor. The attack can also reach another machine signed into the same Claude account.

Who it affects

The attacker first needs an extension with access to claude.ai on the victim's browser. Weizman says that is not hard. A person can be tricked into installing one, but hijacking a legitimate extension is usually easier. He says this happens a lot through supply-chain compromises or a black market for buying real extensions. The user also has to be signed into both claude.ai and Claude Desktop.

What Anthropic has said

Anthropic called the report valid in May, then closed it as a duplicate of a flaw it was already tracking. It paid no bug bounty and issued no CVE, the public ID for known security flaws. It told Weizman it planned to retire Dispatch at the end of October. It did not answer The Register's questions. As of October 30, its support page still listed Dispatch as a limited beta that existing users can keep using.

Weizman says retiring Dispatch would not fix the design problem. He says the same weakness lives on in Claude Cowork sessions and Claude Code Remote Control, which means less need for Dispatch to be switched on. He says he told Anthropic this and it still chose to do nothing.

What to do

If you use Claude's desktop agent, open your browser's extension list. Remove any you do not need or fully trust. Anthropic has not said whether a fix is coming for the underlying design.