Claude Dispatch Could Use Claude Dispatch to Run Code on Users' Computers
Claude Dispatch has published findings on a flaw in how Claude Code-style agents handle untrusted input.
Claude Dispatch has published findings on a flaw in how Claude Code-style agents handle untrusted input.
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.
The attack needs Dispatch , a Claude feature that lets people send tasks from their phone to Claude Desktop.
The flaw that makes this possible can still be exploited, the researchers said earlier this week.
The researchers found that Dispatch also accepted an ordinary signed-in session on claude.ai, the Claude website, even though the site showed no link to it.
The Dispatch help page, last updated late last week, does not mention a retirement.
Any organization running Claude Code-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
That let an extension running on the site send Claude Desktop instructions as if the user had sent them.
It says Dispatch is closed to new users and that people who already use it on some Pro, Max, and Ultra plans The attack needs two things, according to a technical write-up by Forever Security researcher Gal Weizman: an extension that can run scripts on claude.ai, and a person signed in to both claude.ai and Claude Desktop with Dispatch turned on.
The danger here is that the exfiltration path hides inside normal business activity, so a control built to catch obvious attacks has nothing unusual to flag.
Claude Desktop is an AI agent that can run commands on the computer where it is installed.
The extension could be malicious, a legitimate one that received a compromised update, or a legitimate one with a security flaw.
Claude Dispatch's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
The same step could have stolen files or installed a backdoor, given Claude's permissions on the computer, the researchers say.
the researchers wrote, adding that two other Claude features, Claude Code Remote Control and Claude Cowork sessions, let extensions carry out the same attack.
The researchers say Anthropic, the company that makes Claude, told them on October 13 that Dispatch would be retired, with the end of October as the target.
Dispatch itself only works while the computer is awake and the desktop app is open.
In the test, a script on the user's claude.ai page opened Dispatch and sent Claude four prompts as if it were the user.
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.
Because Dispatch connects devices, the extension could also reach Claude Desktop on a different computer signed in to the same Claude account, they say.
What happened
Claude Dispatch has published findings on a flaw in how Claude Code-style agents handle untrusted input.
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.
The attack needs Dispatch , a Claude feature that lets people send tasks from their phone to Claude Desktop.
What changed
The flaw that makes this possible can still be exploited, the researchers said earlier this week.
The researchers found that Dispatch also accepted an ordinary signed-in session on claude.ai, the Claude website, even though the site showed no link to it.
The Dispatch help page, last updated late last week, does not mention a retirement.
Who is affected
Any organization running Claude Code-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
That let an extension running on the site send Claude Desktop instructions as if the user had sent them.
It says Dispatch is closed to new users and that people who already use it on some Pro, Max, and Ultra plans The attack needs two things, according to a technical write-up by Forever Security researcher Gal Weizman: an extension that can run scripts on claude.ai, and a person signed in to both claude.ai and Claude Desktop with Dispatch turned on.
Why it matters
The danger here is that the exfiltration path hides inside normal business activity, so a control built to catch obvious attacks has nothing unusual to flag.
Claude Desktop is an AI agent that can run commands on the computer where it is installed.
The extension could be malicious, a legitimate one that received a compromised update, or a legitimate one with a security flaw.
Technical details
Claude Dispatch's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
The same step could have stolen files or installed a backdoor, given Claude's permissions on the computer, the researchers say.
the researchers wrote, adding that two other Claude features, Claude Code Remote Control and Claude Cowork sessions, let extensions carry out the same attack.
Response
The researchers say Anthropic, the company that makes Claude, told them on October 13 that Dispatch would be retired, with the end of October as the target.
Dispatch itself only works while the computer is awake and the desktop app is open.
In the test, a script on the user's claude.ai page opened Dispatch and sent Claude four prompts as if it were the user.
What security teams should do
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.
Because Dispatch connects devices, the extension could also reach Claude Desktop on a different computer signed in to the same Claude account, they say.
Attribution
The Hacker News: A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.