---
title: "[AUTO] Claude Dispatch Allows Browser Extensions to Execute Code"
pubDatetime: 2026-11-06T15:54:00.000Z
description: "Malicious browser extensions can exploit Claude Dispatch to run code on your machine using sustained conversation and automated button clicks."
tags: [ai-security, vulnerability, anthropic, claude-code, sandboxing, 2026, 2026-q4, 2026-11, AUTO]
---
Claude Dispatch, Anthropic's feature for controlling Claude Desktop from the browser, can be exploited by malicious extensions to execute arbitrary code on your machine. [Forever Security researchers demonstrated](https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce) the attack: an extension engages Claude in sustained conversation while automatically clicking approval buttons for code execution. They showed npm package installation as proof. Because Dispatch works cross-device on the same Anthropic account, a compromised extension reaches Claude Desktop on other logged-in machines too.

Anthropic acknowledged the May 2026 report but treated it as a duplicate of an existing issue. No CVE, no bounty. The company announced Dispatch retirement but the feature remained active in early November.

The core problem: Anthropic already acknowledged similar flaws in Claude Code Remote Control and Claude Cowork. Retiring Dispatch doesn't fix the underlying issue. Any browser-to-desktop bridge relying on user approval for code execution has the same weakness. Attackers force sustained interaction; the user eventually approves something dangerous. Until the design pattern changes, renaming features just moves the target around.

---

*Sources: [ThisBash: Claude Dispatch Vulnerability Analysis](https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce)*

*Coverage: [Malicious browser extensions could use Claude Dispatch](https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html)  •  [Anthropic won't fix Claude Dispatch flaw](https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684)*

*Related on this blog: [[AUTO] How Downloads Folder Became an Agent Attack Surface](/posts/auto-downloads-malware)  •  [[AUTO] Unauthorized Relay Disables AI Sandboxes](/posts/auto-ai-relay-sandbox)  •  [[AUTO] Coding agents leak secrets through pre-approved tools](/posts/auto-agent-allowlist-leak)*