ThisBash: A Browser Extension Can Drive Claude Dispatch to Run Commands on Your Desktop — Anthropic Has No Fix Six Months After the Report

High · 2026-11-12 · By H.A

A researcher showed that any extension able to script claude.ai can task a paired Claude Desktop agent, auto-click its approval prompts and run an npm preinstall payload, and the same session-sharing design reportedly affects Cowork and Claude Code Remote Control.

Overview

A security researcher has disclosed ThisBash, a design weakness in Anthropic's Claude Dispatch. It lets any browser extension that can script the claude.ai page drive the user's paired Claude Desktop agent and make it run commands on the computer. The researcher says the same trust relationship exists in Cowork sessions and Claude Code Remote Control, though this has not been independently reproduced.

Anthropic was told in May 2026. It reportedly accepted the report as valid, then closed it as a duplicate of an issue it was already tracking. No CVE, bounty or specific fix has followed. The findings drew wide attention in the first week of November. No in-the-wild exploitation has been reported.

The Vulnerability

Dispatch launched in March 2026 as a research preview inside Claude Cowork, Anthropic's agentic desktop mode. It lets a user send tasks from a phone to a Claude agent running on their computer. That agent can work with local files, connected services, the browser and desktop applications. Human approval prompts are the main runtime safeguard.

The weakness is architectural. The Dispatch page and its API are reachable from an ordinary logged-in claude.ai web session. That turns the web client into a control plane for local execution, so the desktop is only as safe as the least-trusted client: typically a browser full of third-party extensions. Approval prompts rendered in the page can be satisfied by synthetic clicks, so they don't prove a human is present.

Preconditions:

• a logged-in claude.ai session in the browser;
• a malicious or hijacked extension with host access to claude.ai (or all sites) that can run script in the page context;
• a Claude Desktop agent paired with the same account. Some analysts note it does not have to be on the same machine, while the published demo used one machine.

Timeline

• March 2026: Dispatch introduced as a research preview.
• 14 May 2026: the issue is reported to Anthropic, which accepts it as valid and closes it as a duplicate.
• End of October 2026: Anthropic's reported target date for retiring Dispatch. It still worked for existing users afterwards.
• 30 October 2026: Anthropic's support page lists Dispatch as a limited beta on some Pro, Max and Ultra plans, unavailable to new users.
• 4–7 November 2026: the research is published and widely reported. Anthropic did not answer press questions about the retirement delay.

Tradecraft

The reported attack chain runs entirely through the user's own authenticated channel:

1. Foothold: the extension injects script into the claude.ai tab.
2. Concealment: the script opens Dispatch in a tiny, unfocused popup window.
3. Targeting: it lists sessions to find the victim's desktop agent.
4. Tasking: it sends instructions, rephrasing until the agent complies.
5. Approval: it clicks "Allow" about once a second.
6. Execution: the agent runs a global npm install whose preinstall hook launches the payload.

The proof of concept only opened the calculator. A real attacker would more plausibly steal source code and cloud credentials or install persistence. The model's initial refusals added friction but did not stop the attack. This is not classic prompt injection: the attacker speaks with the user's authority.

The researcher also reports telemetry from six organisations showing that personal Claude accounts made up 18%–71% of Claude accounts seen on corporate networks. That is a route from a home browser into a work laptop. The figures come from the same firm that did the research, and one worked example computes to about 21% rather than 18%, so treat them as indicative.

Detection

• Alert on package-manager installs (npm, pip, brew) and script execution in the Claude Desktop process tree, especially lifecycle hooks such as preinstall and postinstall.
• Monitor outbound connections from processes the agent spawns.
• Inventory browser extensions with host permissions for claude.ai or <all_urls>. Watch for permission changes when extensions update.
• Look for claude.ai Dispatch sessions opened in small popup windows or at odd hours where browser telemetry is available.
• Treat any endpoint with unexplained agent activity as potentially compromised.

Hunting example (macOS/Linux) for npm processes spawned by the desktop app:

ps -eo pid,ppid,comm,args | grep -Ei "npm|node" | grep -v grep
pstree -p $(pgrep -f "Claude" | head -1) 2>/dev/null

Recommended Actions

1. Inventory Claude Desktop installations and find out where Dispatch, remote Cowork control or Remote Control is in use.
2. Disable Dispatch and remote control where they are not needed. On Team and Enterprise plans, review the "Chat and Cowork unified" setting.
3. Enforce extension allowlisting on managed browsers and remove unapproved extensions that can access claude.ai.
4. Require company-managed Claude accounts on corporate devices and block personal-account sign-in where possible.
5. Limit the desktop agent's file and connector scope to what each user actually needs.
6. If you suspect misuse, rotate any credentials, tokens and SSH keys the agent could reach.

Analyst Assessment

ThisBash matters beyond one feature. It shows that agentic assistants with local execution inherit the attack surface of every client allowed to task them. Approval prompts rendered in a web page are not authentication. Exploitation needs a malicious or compromised extension, which is a realistic precondition given how often extensions are sold or hijacked. Rated High: the impact is code execution on developer machines, but the attack is not remotely triggerable without that foothold. Until vendors bind approvals to the originating device and let admins restrict client types, organisations should treat AI agents with local execution as privileged software and govern them that way.