Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries
B · Useful, limited The Register's cybersecurity editor reports a researcher's disclosed attack chain with a proof of concept; the vendor did not respond and the account-mix figures come from a security firm's small customer sample.
Summary based on the full text·Original: about 8 minutes to read
In short
An exclusive by Jessica Lyons (The Register, 5 November 2026). Gal Weizman of Forever Security found that Claude Dispatch, which sends tasks from phone or browser to Claude Desktop, was reachable from an ordinary claude.ai web session. A browser extension with access to claude.ai can therefore prompt the desktop agent to run code, on the same machine or on another machine signed into the same account. Anthropic acknowledged the report in May, closed it as a duplicate, paid no bounty, issued no CVE and did not answer The Register's questions.
Key numbers
- 18 to 71 percentshare of known Claude accounts that were personal accounts, across six Forever Security customer organisations
- 255 of 1,233personal accounts among known Claude accounts at one organisation (18 percent)
- 214 of 695personal accounts at a second organisation (31 percent)
- sixsteps in the published attack chain from browser extension to code execution
As reported by the source.
English·Web page·opens theregister.com
What it reports
- Prerequisite: a malicious or hijacked browser extension with access to claude.ai, and the user signed in to both the web app and Claude Desktop.
- Attack chain: a content script shares the page's session, opens Dispatch in a tiny popup, lists the desktop agent's session, then "force prompts" it, with an auto-click on "Allow" every second, until it installs a malicious npm package.
- The researcher says the same weakness exists in Claude Code Remote Control and Cowork sessions, so retiring Dispatch would not close it.
- Anthropic told the researcher it would retire Dispatch at the end of October; as of 30 October the support page still listed it in limited beta for existing users.
- Cross-machine risk: one account shared between a personal and a work computer turns the browser into an entry point to the corporate laptop.
- In six Forever Security customer organisations, personal accounts were 18% to 71% of known Claude accounts; the other four sat at 30% to 44%. The 71% case had 20 personal accounts out of 28.
- Suggested fix: treat the web client as a lower-privilege device; OpenAI's Codex does not share sessions across web and desktop.
How they got it
Interview with the researcher plus his technical write-up and video proof of concept. Account-mix numbers were shared by Forever Security from what it calls a small subset of its customers.
Limits
- One researcher's claims; no independent reproduction and no vendor response in the article.
- The account sample is six organisations chosen by a firm that sells security tooling.
- The attack needs a compromised extension, which lowers but does not remove the risk.
Why it matters for companies
Agent products that sync sessions across web, mobile and desktop erase the browser's security boundary, so extension control becomes endpoint control. Security teams should inventory browser extensions on machines running desktop agents, block personal AI accounts on work devices, and prefer enterprise tenants where session sharing can be configured. The personal-account range is a rough baseline for how much shadow use a firm may already have.
Summary based on the full text. Read the original for the full argument and data.Read the original on theregister.com
- Tags
- Security, Governance