Claude Dispatch "ThisBash": How a Browser Extension Can Drive Claude Desktop to Run Code

A browser extension that can run on claude.ai can, according to security researcher Gal Weizman, steer Claude Desktop through Dispatch into installing a package and running code on the computer, or on a different computer signed in to the same Claude account. Weizman, of Forever Security, calls the flaw ThisBash. The Register published his findings exclusively on November 5, 2026, reporting that Anthropic has known since May and has not closed the hole. If you run Claude Desktop with Dispatch, Cowork or Claude Code remote sessions, the practical advice is to audit your browser extensions and your account sharing now, because there is no patch to wait for.

We have not reproduced this ourselves, and we could not find Forever Security's own technical report or proof-of-concept video through search. Everything below about the attack comes from The Register's account of that report; Anthropic's product behaviour comes from its Help Center article on Dispatch.

What is Claude Dispatch, and why does it matter here?

Dispatch lets you message Claude from your phone and have it work on your desktop. Anthropic's support page describes it as working "on your desktop computer, using your local files, connectors, plugins, and apps." The desktop app must be open and the machine awake, because the tasks run locally rather than in Anthropic's cloud. The page also states that Dispatch is in limited beta on some Pro, Max and Ultra plans, is not available to new users, and that existing users "can keep using it for now."

The same page is unusually frank about the risk: "Giving a mobile AI agent remote control of a desktop AI agent creates a chain where instructions from your phone can trigger real actions on your computer: reading, moving, or deleting local files, interacting with connected services, controlling your browser, and using your desktop apps." It adds that malicious content the model encounters, or a manipulated instruction, could cascade into actions that are hard to undo.

The ThisBash report is about who else can be the "phone." If the web session at claude.ai can address the same agent sessions, then anything that controls that web session is effectively a trusted remote.

How the attack works, step by step

According to The Register's summary of Weizman's technical report, the chain has six steps. The prerequisite is a browser extension with access to claude.ai, with the victim signed in to both Claude on the web and Claude Desktop.

1. The extension injects a script. It registers a MAIN-world content script on claude.ai. That shares the page's JavaScript context and the user's session cookies, so the script acts as the logged-in user.
2. A small popup opens Dispatch. The script opens the Dispatch page (https://claude.ai/cowork/agent) in a tiny, unfocused popup. Weizman describes this as the only visible trace of the whole sequence.
3. It discovers the desktop agent. Using ambient cookies, the script calls GET /v1/sessions?tags=cowork-dispatch-local. The response includes the session ID of the Claude Desktop agent running on the user's machine.
4. It "force prompts" the agent. The script writes a prompt into the composer and sends it, telling the agent what to do.
5. It pushes past hesitation. If the agent grows suspicious, the script keeps talking to it. The published prompts start with a casual request to list working folders, move to asking Claude to run npm install -g for a named package through Claude Code, and then insist when the agent pushes back.
6. It auto-approves. Because Claude asks for approval before acting, the script clicks "Allow" on a one-second interval, so a prompt that nobody is watching does not stop the chain. The loop repeats until code runs.

In the proof of concept, the payload was a package with a preinstall.js hook that opens the calculator. Weizman's point is that a real payload could steal source code and cloud credentials or install a backdoor. The Register quotes him on Anthropic's decision: "They still decided not to do anything about it."

This is the same trust problem Beam has covered elsewhere: an agent that takes instructions from a channel the user does not fully control. Our write-up of the embedded-browser flaws in Cursor, Copilot, Claude, Codex and VS Code and the Claude Code Desktop preview-pane exfiltration describe other places where a browser-shaped surface reached files outside its box.

Why the blast radius is bigger than one machine

Two details in the report widen the impact.

Cross-machine reach. Dispatch is built to work across devices. If the compromised web session can reach a desktop agent on another computer, the browser becomes a remote entry point. On the same machine it is a sandbox escape from the browser; across machines it is lateral movement.

Shared personal and work accounts. Weizman says Forever Security commonly sees one Claude account used on both home and corporate laptops. The firm shared numbers for six customer organisations: personal Claude accounts among known accounts ranged from 18 percent to 71 percent. In one, 255 of 1,233 known accounts (18 percent) were personal; in another, 214 of 695 (31 percent); in the highest, 20 of 28. Those figures come from the firm and are a small subset of its customers, so treat them as indicative, not a measurement of the wider market. The scenario they point to is a personal browser, with a risky extension, bridging into a work laptop that the attacker had no other way to reach.

The researcher also argues the problem is not limited to Dispatch. He says the same weakness lives on in Claude Code Remote Control and Claude Cowork sessions, which are reachable from the web version and share sessions with the desktop version, so retiring Dispatch would not remove it.

What Anthropic has said and done

Per The Register:

• Weizman disclosed the issue in May 2026.
• Anthropic acknowledged it as a valid vulnerability but closed it as a duplicate of a flaw it was already tracking.
• No bounty was paid and no CVE was issued.
• Anthropic told him it planned to retire Dispatch at the end of October. That has not happened; as of October 30 the support page still describes a limited beta.
• Anthropic did not respond to The Register's questions, including when it plans to retire the feature.

Weizman proposed a remediation: treat the web client as a separate, lower-privilege device, so a request from the web to run commands or take other out-of-scope actions on a desktop agent would be blocked. He contrasts this with OpenAI's Codex, where, he says, web sessions cannot see or interact with sessions started on the desktop. We have not verified that comparison, and Anthropic has not published a response.

It is worth noting this is not the first time a Chrome-side trust issue has been raised for Claude. Our post on the exploit.cat disclosure about Claude session bridges covered another case where Anthropic disputed or reclassified a researcher's finding. In both, the useful move for readers is to work from what is documented and reduce exposure, not to wait for a vendor statement.

What this means if you run AI coding agents

No patched version exists, so these are risk-reduction steps. None is a fix.

• Audit extensions that can read claude.ai. Open your browser's extensions page and review each extension's site access. Remove anything you do not use, and set the rest to "on click" or to specific sites where the browser allows it. The attack needs only an extension with access to claude.ai, and hijacked legitimate extensions count.
• Separate personal and work Claude accounts. Do not sign a work laptop in to a personal account, or the reverse. Cross-machine reach depends on both desktops sharing one account.
• Turn Dispatch off if you do not use it. Anthropic says it is a limited beta not offered to new users. Check the Cowork and Claude Code remote-session settings for your plan and disable remote or web access you do not need. The exact setting names vary by plan and version; follow Anthropic's Help Center for your plan.
• Do not leave approval prompts unattended. The attack auto-clicks "Allow." An agent that waits for a human who is not there is not a control. Prefer narrow allow rules over blanket approvals, and watch for approvals you did not request.
• Look for the trace. The only visible sign the researcher describes is a tiny unfocused popup on claude.ai/cowork/agent. Afterwards, look for unexpected global npm installs (npm ls -g --depth=0), new shell history entries, and sessions in your Claude session list that you did not start.
• Treat unusual package installs as an incident. If a global npm package appeared that you did not choose, rotate cloud and Git credentials from a clean machine. Our guide to fake Claude Code installers lists what such installers typically go after.
• Ask your vendor and your IT team. If your organisation permits Claude Desktop, ask whether Dispatch and remote sessions are allowed by policy, and whether personal accounts are blocked on managed devices. Endpoint tooling can see process activity but not the intent behind it; see what an EDR sensor sees and misses with Cowork.

What Beam can and cannot do here

Beam does not sit between a browser extension and Claude Desktop. It does not see claude.ai traffic, Dispatch messages or extension behaviour, and it cannot stop the "Allow" click in Claude Desktop's own interface.

Where it can help is one step downstream. In the published prompts, the desktop agent is asked to invoke Claude Code to run npm install -g. On a machine where Beam's agent hooks are installed for Claude Code, a risky tool call such as a global install from an unfamiliar package can be flagged, and in workspace enforce mode a PreToolUse hook can deny it. That is a hook-based check on Claude Code and Codex, not a kernel sandbox; if a cached policy is missing the hook fails open, and it only covers what passes through those hooks. Beam also keeps its records on-device and redacts known credential formats before storage, which limits what a later review exposes. For setup, see the introduction to Beam and the landing page overview. Treat this as a second line of defence, not a substitute for removing the risky extension.

What to watch next

• Whether Anthropic publishes a statement, a CVE or a design change for web-to-desktop session control.
• Whether Dispatch is actually retired, and whether Cowork and Claude Code remote sessions get a separate trust level for web clients.
• Publication of Forever Security's technical report and video, which would let others check the six steps independently.
• Related incidents are tracked in the November 2026 attacks timeline.

Frequently asked questions

What is the Claude Dispatch "ThisBash" flaw?

It is a reported attack in which a browser extension with access to claude.ai uses the logged-in web session to send prompts to Claude Desktop through Dispatch, then approves the agent's permission prompts until it installs a malicious npm package or runs code. The researcher is Gal Weizman of Forever Security; the details come from his report as covered by The Register.

Has Anthropic fixed it or issued a CVE?

According to The Register, no. Anthropic acknowledged the report in May as valid, closed it as a duplicate of a known issue, paid no bounty and issued no CVE. It reportedly told the researcher it planned to retire Dispatch at the end of October, but its support page still lists Dispatch as a limited beta that existing users can keep using.

Do I need a malicious extension for this to work?

Yes. The attack needs a browser extension that can run on claude.ai, and you must be signed in to Claude on the web and to Claude Desktop. The researcher notes that hijacking a legitimate extension is often easier than getting a new one installed.

Can it reach a different computer?

The report says yes. Dispatch is designed to work across devices, so a compromised browser session can reach a desktop agent on another machine signed in to the same account, such as a work laptop that shares a personal Claude account.

What can I do today?

Audit extensions that can read claude.ai, avoid sharing one Claude account between personal and corporate machines, turn off Dispatch and remote or web access to desktop sessions if you do not use them, and do not leave permission prompts unattended. Treat these as risk reduction, not a fix.

Can Beam stop this?

Only partly. Beam cannot see Claude Desktop or Dispatch traffic or the browser. If the agent hands work to Claude Code on a machine with Beam hooks installed, Beam can flag or deny risky tool calls there, but that is a hook-based check, not a sandbox.

Related reading

• Embedded browser flaws in Cursor, Copilot, Claude, Codex and VS Code
• Claude Code Desktop preview-pane exfiltration
• Claude session-bridge tokens and the exploit.cat disclosure
• Claude Cowork and EDR: what the sensor sees and misses
• November 2026 attacks timeline

Details are accurate as of November 5, 2026, based on press coverage of a researcher's report and Anthropic's Help Center; Beam is a local prototype and its coverage is limited to what its documented hooks and scans can see. We will update this post if Anthropic responds.