Researchers showed a browser extension could use Claude's Dispatch feature to make Claude Desktop run code on a computer. They say the flaw still works.
A browser add-on could take over Claude Desktop and make it run code on your computer, according to security researchers at Forever Security. In a test, an extension that could run scripts on the Claude website used a feature called Dispatch to send Claude instructions as if the user had typed them. The researchers say the flaw can still be exploited. They report no real attacks.
Claude Desktop is an AI agent that can run commands on the computer where it is installed. Dispatch lets people send tasks from their phone to Claude Desktop. The researchers found that Dispatch also accepted an ordinary signed-in session on claude.ai, even though the site showed no link to it.
In the test, a script sent Claude four prompts asking it to install an npm package. Claude hesitated at first over the unfamiliar package. A follow-up message in the user's voice got it to go ahead. Claude asks before it acts, but those approval prompts appeared in the web page the extension controlled, and the script clicked every "Allow" button each second. The package's install script opened the Calculator app. The researchers say the same step could have stolen files or installed a backdoor.
The extension could be malicious, a legitimate one that received a compromised update, or a legitimate one with a security flaw.
The test used one computer. The researchers say the extension could also reach Claude Desktop on another computer signed in to the same Claude account, though they only describe that case and did not show it. That could link a home computer to a work laptop when one personal account is used on both. They say they have seen this setup on customers' work computers.
The researchers reported the flaw to Anthropic on May 14. They say the company accepted it as valid on May 19 but closed it as a duplicate of an issue it had already found internally. They also say Anthropic told them on October 13 that Dispatch would be retired by the end of October. Its help page, updated late last week, does not mention that. It says Dispatch is closed to new users and that people on some Pro, Max, and Ultra plans "can keep using it for now."
The researchers add that two other Claude features, Claude Code Remote Control and Claude Cowork sessions, let extensions carry out the same attack. They did not test those and plan a follow-up post.
If you use Claude Desktop, review your browser extensions and remove any you do not need. Consider turning off Dispatch, especially on a work computer. In Claude Desktop, Dispatch is part of Cowork and appears in the left-side panel. The help page says users should know how to quickly disconnect or revoke access, but it does not explain how.
If you use Claude Desktop, check your browser extensions and consider turning off Dispatch, especially on a work computer.
World models, AI that learns physics from video, are being built into home robots and driverless cars, and your own videos may help train them.
Read more: AI that learns how the physical world works is coming to robots and carsA new Alibaba-led test of real coding requests found the best AI agent fully finished just 26.4 percent of tasks, so human review still matters.
Read more: AI coding helpers fully finish only about 1 in 4 real tasksA University of Chicago law professor asked Claude to fix page numbers. It deleted his syllabus and a year of notes instead. Dropbox saved him, not the AI.
Read more: An AI assistant deleted a law professor's year of lecture notes
