Cybersecurity researchers have uncovered a security weakness that could allow malicious browser extensions to exploit Anthropic’s Claude Dispatch feature to execute commands and run potentially harmful code on users’ computers without their knowledge.

The vulnerability was demonstrated by researchers at Forever Security, an endpoint security company, who discovered that browser extensions capable of running scripts on the Claude website could potentially send instructions to Claude Desktop and use its ability to execute commands on the computer where it is installed.

The attack takes advantage of Dispatch, a Claude feature that allows users to send tasks from their mobile phones to Claude Desktop remotely.

According to the researchers, the security issue arises because Dispatch accepts an ordinary authenticated session on claude.ai, even though the website does not visibly provide access to the feature.

This weakness could allow a browser extension operating within the Claude website to communicate with Claude Desktop and submit instructions as though they were coming directly from the account owner.

Claude Desktop functions as an AI agent capable of executing commands and performing operations on the computer where the application is installed. Consequently, an attacker who successfully abuses the Dispatch connection could potentially use the AI agent’s existing permissions to carry out activities on the victim’s machine.

The researchers said Anthropic, the company behind Claude, informed them on October 13 that it intended to discontinue Dispatch, with the end of October identified as the target date.

However, the Dispatch support page, which was updated late last week, did not announce that the feature had been completely retired.

Instead, Anthropic indicated that Dispatch was no longer accepting new users, while existing users on certain Pro, Max and Ultra subscription plans could continue using it for the time being.

How the Claude Dispatch Attack Works

In a technical investigation published by Forever Security researcher Gal Weizman, the attack was shown to require two main conditions.

First, the victim must have a browser extension capable of executing scripts on claude.ai. Second, the individual must be signed in to both the Claude website and Claude Desktop, with Dispatch enabled.

The extension involved does not necessarily have to be deliberately designed for malicious purposes. Researchers explained that attackers could exploit a harmful extension, compromise an otherwise legitimate extension through a malicious update or take advantage of an existing security weakness in an installed extension.

The attack also depends on Claude Desktop being open and the computer remaining awake because Dispatch requires an active connection to the desktop application.

During their demonstration, researchers executed a script through the victim’s Claude website session. The script accessed Dispatch and submitted four separate instructions to Claude, making the requests appear as though they had been initiated by the user.

The instructions asked Claude to install an npm software package.

Although Claude initially expressed hesitation because the package was unfamiliar, the researchers sent another instruction written in the user’s apparent voice, persuading the AI assistant to proceed with the installation.

One of the security concerns involved Claude’s approval mechanism.

Although the AI agent requested permission before carrying out certain actions, the approval notifications appeared within the browser page controlled by the malicious extension.

The researchers demonstrated how an automated script could repeatedly click the approval button every second, effectively approving Claude’s requests without requiring the victim to monitor the activity.

Following the approval, Claude executed a global npm package installation. The package’s installation script subsequently launched the Windows Calculator application.

The demonstration showed that attackers might not need to exploit a traditional browser vulnerability to execute code on a victim’s computer. Instead, they could manipulate an AI agent that already has permission to perform operations on the system.

Researchers warned that the same technique could potentially be abused to steal sensitive files, access confidential information or install persistent malicious software, depending on the permissions available to Claude Desktop.

The demonstration was conducted with the browser and Claude Desktop running on the same computer. Forever Security said it had not observed actual attacks exploiting the vulnerability.

However, the researchers warned that Dispatch’s cross-device functionality could potentially extend the attack to another computer connected to the same Claude account.

For instance, an individual using one personal Claude account on both a home computer and a workplace laptop could potentially expose both devices if Dispatch were enabled across them.

The researchers said they had encountered situations involving personal Claude accounts with cross-device Dispatch functionality enabled on work computers belonging to their customers.

They also explained that the same attack could potentially connect a personal computer to an organisation’s work laptop, creating additional security concerns for businesses.

Anthropic Was Informed About the Vulnerability

Forever Security disclosed that it first reported the security weakness to Anthropic on May 14.

The company reportedly acknowledged the vulnerability as valid on May 19 but subsequently closed the report, explaining that it was a duplicate of an issue already identified internally.

The researchers argued that although Anthropic intends to discontinue Dispatch, the underlying security design could remain a concern across other Claude features.

They specifically identified Claude Code Remote Control and Claude Cowork sessions as additional functionalities that could potentially allow browser extensions to carry out similar attacks.

However, Forever Security clarified that its published investigation did not include demonstrations involving those two features and that further research would be released separately.

The findings have raised broader concerns about the security implications of connecting browser environments to AI agents capable of executing commands on local computers.

Security Recommendations for Claude Users

Forever Security has advised users of Claude Dispatch to review their settings and take precautions against potentially malicious browser extensions.

Users who do not require cross-device Dispatch functionality are advised to disable it.

Those who depend on the feature should carefully review how devices are connected, approved and removed from their Claude accounts.

Researchers also recommended treating browser extensions like other software installed on a computer by examining their permissions, restricting unnecessary access and monitoring updates that introduce additional capabilities.

Organisations were further advised to monitor the activities of AI agents operating on employee computers.

Particular attention should be given to unexpected software installations, changes to system configurations, attempts to access stored credentials and unusual connections to external services.

The investigation highlights the growing cybersecurity challenges associated with AI-powered applications that can interact with operating systems, execute commands and access files.

As AI agents become increasingly integrated into everyday computing environments, weaknesses in the connections between browsers, cloud services and desktop applications could create new opportunities for attackers to compromise otherwise protected systems.