A malicious browser extension running on the Claude website could force Claude Desktop to execute code on a user's computer, according to security researchers at Forever Security, an endpoint security firm, who demonstrated the vulnerability in testing announced this week. The exploit relies on Dispatch, a Claude feature that allows users to send tasks from their mobile devices to Claude Desktop. The vulnerability remains exploitable, the researchers said.
The attack requires two components, according to a technical write-up by Forever Security researcher Gal Weizman: a browser extension capable of running scripts on claude.ai, and a user logged into both claude.ai and Claude Desktop with Dispatch enabled. The malicious extension could be an intentionally harmful add-on, a legitimate extension that received a compromised update, or a legitimate extension with a security weakness. In the test, a script operating on the user's claude.ai page launched Dispatch and delivered four prompts to Claude as though they originated from the user. These prompts instructed Claude to install an npm package. Claude initially balked at the unfamiliar package, but a subsequent message, appearing in the user's voice, persuaded it to proceed. Claude requests approval before taking action, but those authorization prompts appeared in the web page the extension controlled. The script clicked any "Allow" button every second, eliminating the need for human oversight. Claude then executed a global npm install, and the package's install script launched the Calculator app. The same process could have exfiltrated files or installed a backdoor, given Claude's permissions on the machine, the researchers say.
The researchers discovered that Dispatch accepted an ordinary authenticated session on claude.ai, even though the website displayed no connection to the feature. This allowed an extension running on the site to transmit instructions to Claude Desktop as if the user had initiated them. The researchers reported the flaw to Anthropic, the company behind Claude, on May 14. Anthropic validated it on May 19 but closed the report as a duplicate of an issue already identified internally, according to the researchers. Anthropic informed the researchers on October 13 that Dispatch would be retired, with a target date at the end of October. The Dispatch help page, last updated late last week, doesn't mention a retirement but states Dispatch is closed to new users and that existing users on certain Pro, Max, and Ultra plans "can keep using it for now."
Because Dispatch connects devices, the extension could also access Claude Desktop on a separate computer logged into the same Claude account, the researchers say. This reach could link a home computer to a work laptop when someone uses a single personal Claude account across both devices with Dispatch active. The researchers have observed personal Claude accounts with cross-device Dispatch enabled on work computers at their customers. "Anthropic is retiring Dispatch, but not the design behind it," the researchers wrote, adding that two other Claude features, Claude Code Remote Control and Claude Cowork sessions, allow extensions to execute the same attack. The researchers recommend users turn off cross-device Dispatch if unnecessary, review how devices are paired and removed, treat browser extensions like other software by checking permissions and monitoring updates, and watch for unexpected AI agent behavior including package installations, setting changes, credential access, and external connections. For organizations deploying AI agents with system-level access, the incident highlights a fundamental tension between convenience and control that traditional application sandboxing was designed to prevent. The vulnerability also raises questions about whether consumer-grade authentication models can adequately govern enterprise workflows when personal accounts bridge home and workplace devices.