Anthropic leaves a Claude Dispatch RCE flaw unfixed
A disclosed flaw lets any browser extension with access to claude.ai hijack Claude Desktop into running commands on your machine, or a different one signed into the same account.
Security researcher Gal Weizman has disclosed a flaw, nicknamed ThisBash, in Claude Dispatch, the Claude Desktop feature that lets you send instructions from your phone or a browser tab to a code-capable agent running on your computer. Any browser extension with access to claude.ai, planted deliberately or hijacked through a supply-chain compromise, can inject a script that opens a hidden popup, grabs your desktop session ID, and sends a stream of self-approving prompts until it has run arbitrary code on the machine.
Weizman’s proof of concept ran npm install -g add-colors-to-bash with a malicious preinstall script that popped open Calculator. Because Dispatch works across any device signed into the same Claude account, the same chain can reach a personal laptop from an attacker-controlled browser elsewhere, or jump from a personal account logged into a work machine. He reported it to Anthropic on 14 May 2026. Anthropic confirmed it was valid five days later, closed it as a duplicate of an issue already being tracked, and told him Dispatch would be retired by the end of October. It is still live, with no CVE issued and no bounty paid.
Why it matters: if you run Claude Desktop with Dispatch turned on, any browser extension that can reach claude.ai is effectively trusted with code execution on your machine. Check which extensions have that access, and turn off cross-device Dispatch if you don’t rely on it.
The caveat: this is a disclosed research finding with a working proof of concept, not a vulnerability seen exploited in the wild, and Anthropic hasn’t commented publicly on the record.