A design flaw in Claude Dispatch allows a malicious browser extension to access the operating system through Claude Desktop, including on a different computer This article explores dispatch allows malicious. . Forever Security researcher Gal Weizman disclosed the attack, which he calls ThisBash, on November 4, 2026.
The web interface simply omitted the navigation link, effectively hiding the feature without enforcing any authorization boundary. An extension with host permissions for Claude.ai can register a MAIN-world content script that shares the page’s JavaScript context and session cookies.
It then initiates a GET request to /v1/sessions?tags=cowork-dispatch-local with ambient cookies, which retrieves the session ID of the desktop agent on the victim’s machine. The Anthropic Claude Desktop command-execution attack chain coverage revealed a similar trust issue, where cross-device preference syncing transformed a chat assistant into a command channel. The package’s preinstall.js hook opened Calculator, potentially exfiltrating files, planting SSH keys, or installing a backdoor.
This scenario results in a sandbox escape on a single machine, while cross-machine remote code execution occurs across two machines due to the Dispatch pairing mechanism. An extension installed within a home browser becomes a potential entry point for unauthorized access to a corporate endpoint housing sensitive information, including source code and cloud credentials. The root cause lies in Claude Code Remote Control and Cowork sessions, allowing web extensions to drive a local agent by design.
