Researcher Says Anthropic Has Known Since May About a Claude Dispatch Flaw That Lets Browser Extensions Run Commands on Your PC

A vulnerability in Anthropic's Claude products lets any browser extension that can control the claude.ai web session make Claude Desktop run commands on the user's computer — or on a different machine signed into the same Claude account — with no browser exploit and minimal user interaction, according to research by Forever Security's Gal Weizman published via The Register. Anthropic has been aware of the problem since May and has taken no action to close it, the report says.

The flaw sits in Claude Dispatch, a feature that lets users send and manage tasks from a phone or browser to Claude Desktop, an AI agent that executes commands locally. Weizman found that Dispatch's interface and API are reachable from an ordinary logged-in claude.ai session. That means a browser extension able to control claude.ai can send commands to Claude Desktop as if they came from the legitimate Dispatch user.

"That extension was able to perform a classic escalation of privileges. Because now Claude has access to the files in the operating system, it can run code on the operating system and compromise the machine completely," Weizman told The Register. "We're talking about millions of installs." Anthropic's own usage data puts claude.ai at roughly 950 million monthly visits as of mid-2026, with 1.2 million sampled Cowork sessions from more than 600,000 organizations during May.

Anthropic acknowledged Weizman's report as a valid vulnerability in May but closed the security issue as a duplicate of a flaw it was already tracking, and paid no bounty or issued a CVE, per the report. The company told him it planned to retire Dispatch at the end of October — which did not happen. As of October 30, the official Claude support page still listed Dispatch as available in limited beta on some Pro, Max and Ultra plans, though closed to new users. Anthropic did not respond to The Register's questions about when it plans to retire the feature.

Weizman argues the problem is deeper than one feature: the same design weakness lives on in other capabilities such as Claude Code Remote Control and Claude Cowork sessions. "Claude Cowork is now accessible via the web version, and it shares the same sessions as you can access in the desktop version," he said, describing how an extension could use a Cowork session to read files, install a malicious npm package or run operating-system commands. "It started with a vulnerability. And it ended up being a design choice that enables this attack vector very easily."

The published attack chain has six steps: the extension registers a MAIN-world content script on claude.ai, sharing the page's JavaScript context and the user's session cookies; it opens the Dispatch page in a tiny, unfocused popup — the only visible trace of the exploit; and it then queries the sessions API and drives the agent. The prerequisite is a browser extension with access to claude.ai, which Weizman says is not hard to obtain: attackers can trick users into installing one, or hijack a legitimate extension through supply-chain compromise or the black market for bought extensions, which he says "happen a lot."

Anthropic did not respond to the researcher's or the publication's questions, and this article reflects the findings of Weizman and The Register; the company's position is only known through its earlier ticket responses described in the report. For enterprises rolling out agent products that bridge browser sessions and local execution, the episode is a reminder that the boundary between a web session and a desktop agent is itself an attack surface — one that vendors have an incentive to patch quietly, and researchers an incentive to document loudly.