Claude Dispatch, Anthropic’s feature for controlling Claude Desktop from the browser, can be exploited by malicious extensions to execute arbitrary code on your machine. Forever Security researchers demonstrated the attack: an extension engages Claude in sustained conversation while automatically clicking approval buttons for code execution. They showed npm package installation as proof. Because Dispatch works cross-device on the same Anthropic account, a compromised extension reaches Claude Desktop on other logged-in machines too.
Anthropic acknowledged the May 2026 report but treated it as a duplicate of an existing issue. No CVE, no bounty. The company announced Dispatch retirement but the feature remained active in early November.
The core problem: Anthropic already acknowledged similar flaws in Claude Code Remote Control and Claude Cowork. Retiring Dispatch doesn’t fix the underlying issue. Any browser-to-desktop bridge relying on user approval for code execution has the same weakness. Attackers force sustained interaction; the user eventually approves something dangerous. Until the design pattern changes, renaming features just moves the target around.
Sources: ThisBash: Claude Dispatch Vulnerability Analysis
Coverage: Malicious browser extensions could use Claude Dispatch • Anthropic won’t fix Claude Dispatch flaw
Related on this blog: [AUTO] How Downloads Folder Became an Agent Attack Surface • [AUTO] Unauthorized Relay Disables AI Sandboxes • [AUTO] Coding agents leak secrets through pre-approved tools