A Malicious Browser Extension Could Make Claude Desktop Run Code Through Dispatch — Anthropic Is Retiring the Feature, Not the Design, Researchers Say
Researchers showed that any script on claude.ai could use Claude's Dispatch feature to make Claude Desktop install an npm package and run code, and say the flaw reported in May still worked this week while Anthropic retires Dispatch.
Security researchers say a malicious browser extension could make Claude Desktop run commands on a user's computer through Dispatch, Anthropic's feature for sending tasks from a phone to the desktop app. The researchers reported the issue in May. Anthropic's response is to retire Dispatch, but as of this week the researchers said the attack "can still be exploited," and they warn that the design behind it lives on in other features.
What Happened
Dispatch is part of Claude's Cowork features and appears in the side panel of the Claude apps. It lets a user send a task, for example from a phone, to Claude Desktop, which can then act on the computer where it is installed, including running commands.
Researchers at an endpoint security company found that Dispatch accepted instructions from an ordinary signed-in claude.ai web session. The site has no visible link to Dispatch, but any script running on claude.ai could use the session to send Claude Desktop instructions as if the user had written them.
The timeline, as described by the researchers:
- 14 May 2026 – the flaw was reported to Anthropic.
- 19 May – Anthropic accepted it as valid but closed it as a duplicate of an issue it had already found internally.
- 13 October – Anthropic said Dispatch would be retired, with the end of October as the target.
- Early November – the researchers said the flaw could still be exploited. Dispatch is now closed to new users, while existing users on some Pro, Max and Ultra plans "can keep using it for now," and the Dispatch help page does not mention a retirement.
No CVE has been assigned, and the researchers report no real-world attacks.
Technical Details
The attack needs three things:
- A browser extension that can run scripts on claude.ai. It could be malicious, a legitimate extension pushed a compromised update, or a legitimate extension with its own security flaw.
- A user signed in to both claude.ai and Claude Desktop, with Dispatch enabled.
- A computer that is awake with the desktop app open.
In the researchers' test, a script opened Dispatch and sent four prompts asking Claude to install an npm package. Claude hesitated at first, but a follow-up message written in the user's voice got it to proceed. Claude's approval prompts appeared in the web page, which the extension controlled, so the script simply clicked any "Allow" button every second.
Claude then ran a global npm install. The package's install script opened the Calculator app as a harmless proof. The researchers point out that the same step could have stolen files or installed a backdoor with whatever permissions Claude Desktop has. No browser exploit was needed.
They also describe, but did not demonstrate, a cross-device version. Because Dispatch is tied to the Claude account, an extension in one browser could reach Claude Desktop on a different computer signed in to the same account. The researchers say they have seen personal accounts with cross-device Dispatch enabled on work computers at customer sites.
Who Is Affected
- Existing Dispatch users who still have it enabled, especially with Claude Desktop running on a work machine.
- Organisations that do not control which browser extensions employees install, or which personal AI accounts are signed in on company devices.
- Potentially, users of similar features. The researchers say Claude Code Remote Control and Claude Cowork sessions could allow the same kind of attack, but they have not tested this and plan a follow-up.
Anthropic's Response
Anthropic accepted the report and decided to retire Dispatch. The researchers argue that this removes one entry point but not the underlying pattern, a web session that can drive a local agent with approvals the web page can click, and wrote that Anthropic is retiring Dispatch "but not the design behind it."
What To Do Now
- Turn off Dispatch and cross-device features you do not use. If you need them, review which devices are paired and remove any you do not recognise.
- Audit browser extensions, especially ones with "read and change data on all sites" permission. Keep an allow-list in managed browsers and review updates that request new permissions.
- Separate personal and work AI accounts. Do not sign a personal Claude account in to Claude Desktop on a corporate machine.
- Watch what AI agents do on endpoints: unexpected global package installs, configuration changes, credential access and new outbound connections from the desktop app's process tree.
- Limit what the agent can do. Run desktop agents as a standard user, and avoid granting them blanket approval for shell commands.
On a Linux or macOS workstation, a quick way to spot recent global npm installs:
# Recently modified global npm packages
ls -lt "$(npm root -g)" | head -20Why It Matters
Desktop AI agents turn chat sessions into remote control. Every way of sending them instructions, whether a phone, a browser tab or a paired device, becomes part of the attack surface, and browser extensions already have broad access to the pages users trust most.
The approval prompt is supposed to be the safety net, but here it was displayed somewhere the attacker controlled. As more vendors add features that let one surface drive another, the safeguard has to be where the attacker cannot reach it: on the device that executes the action, bound to a person and not just a session cookie.
