In a laboratory demonstration, a browser extension used Claude Dispatch to make Claude Desktop execute code. Forever Security researcher Gal Weizman published the finding, named ThisBash, on November 4.
The setup required extension access to claude.ai, a signed-in web session and a desktop using the same account with Dispatch enabled. The ordinary web login also authenticated Dispatch requests, allowing browser code to submit instructions to the desktop agent.
Four prompts and automated approval clicks led to a package installation that opened Calculator. No browser exploit was needed. This was a proof of concept; the report does not establish an active attack campaign.
Retirement remains a reported plan
Weizman says Anthropic received the report on May 14, accepted it as valid but closed it as a duplicate on May 19, and said on October 13 it planned to retire Dispatch by October’s end. That timeline comes from the researcher’s disclosure account.
Anthropic’s current help page describes Dispatch as a way to assign desktop work from a phone. The computer must remain awake with Claude Desktop open, and both devices need an internet connection. Local files, configured connectors, plugins and desktop applications can be involved.
The page still lists Dispatch as a limited beta on some Pro, Max and Ultra plans. New users cannot join, while existing users may continue for now. That availability statement does not confirm that retirement has finished or that this execution path has been fixed.
Anthropic also warns that manipulated instructions and unexpected commands can produce consequential desktop actions. Its guidance is to understand which files and accounts are reachable and how to disconnect or revoke access.
Review the browser permissions too
Chrome users can review extensions through Manage extensions, open an extension’s Details and check its site access. Google’s instructions explain how to restrict access to particular sites or require a click before access, and how to disable or remove an extension. Removing unnecessary access to claude.ai is a concrete place to start.
For administrators, the practical review question is where instructions and approvals originate. A confirmation button offers little protection if the same compromised interface can press it. Teams should therefore include browser permissions when reviewing an agent’s access to their computers.
