{"resourceId":"forever-security-thisbash-claude-dispatch-extension-rce-20261104","versions":[{"version":"external-19a2f2f033744f69bbd6a0d7a18fdd19b6f9ae7939bcb8aba5c07dcc147acda3","resource":{"id":"forever-security-thisbash-claude-dispatch-extension-rce-20261104","title":"Forever Security: a browser extension on claude.ai could drive Claude Dispatch to run code through Claude Desktop, even on another machine signed in to the same account","organization":"Forever Security","sector":"Cross-sector endpoint security (applies to agencies and campuses running Claude Desktop)","geography":"Global; researcher observations from customer environments","publishedAt":"2026-11-04","publicationDate":"2026-11-04","eventDate":null,"sourceName":"Forever Security blog","sourceLabel":"Independent security research (commercial endpoint-security vendor)","sourceUrl":"https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce/","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["developers-agents","data-security","governance-procurement"],"finding":"Source finding: researcher Gal Weizman reports that Claude Dispatch's interface and API were reachable from an ordinary logged-in claude.ai session, so an extension able to script claude.ai could send prompts to Claude Desktop as the user. In the proof of concept, four prompts plus a script that clicked 'Allow' every second got Claude to run a global npm install whose preinstall hook opened Calculator. Disclosure timeline per the researcher: reported May 14, 2026; Anthropic acknowledged validity May 19 and closed it as a duplicate of an internally known issue; on Oct 13 Anthropic said Dispatch would be retired, targeting end of October 2026. Researcher claim (not demonstrated in this write-up): Claude Code Remote Control and Cowork sessions allow the same attack. The firm says it has seen personal Claude accounts with cross-device Dispatch enabled on corporate endpoints. Why now: published Nov 4 and reported Nov 5-6; not previously archived.","sledRelevance":"Directly relevant to state agencies, local governments, school districts and universities that deploy Claude Desktop, Cowork or Claude Code, or that tolerate staff signing in to personal Claude accounts on managed devices. The attack path crosses from a home browser to a work laptop when one personal account spans both. The write-up did not test Claude for Government or enterprise tenants, so applicability to managed tenants is unverified.","evidence":"Single-researcher proof of concept with published code steps; same-machine execution demonstrated; cross-machine path described but not shown in the write-up. No real-world exploitation reported. No CVE or Anthropic public advisory found during this run. Personal-account observations are vendor-reported from unnamed customers.","architectureImplications":"Treats an authenticated web session as authorization for local agent commands. Agencies should map which Claude surfaces (web, desktop, mobile, Code Remote Control, Cowork) can drive a local agent and whether approval prompts render in a page an extension can control.","governanceImplications":"Supports policies that restrict Claude use on managed devices to enterprise or government tenants, disable unneeded cross-device features, and govern browser extensions as endpoint software.","securityPrivacyImplications":"A compromised or malicious extension could cause file reads, code changes, credential theft or persistence within Claude Desktop's permissions. Approval dialogs inside an attacker-controlled page do not establish user consent.","caveats":"Vendor research published alongside product marketing; claims about Remote Control and Cowork are untested in this post; Anthropic's current position and any fix after Oct 30 were not confirmed. Feature availability differs by plan and tenant.","streamIds":["anthropic"],"roles":{"sales":"Sales framing: this is a governance conversation, not a reason to stall adoption. Customers expanding Claude Desktop or Cowork need evidence that personal accounts are blocked on managed devices, cross-device features are controlled, and extensions are governed. Position a bounded agent-surface review that inventories accounts and features and maps approval channels. Do not claim managed government tenants are affected or unaffected, and do not promise that any control removes the risk; the research tested a consumer-plan feature on one machine.","engineering":"Engineering framing: validate the trust boundary between the web session and the local agent. Check whether Dispatch, Remote Control or Cowork web sessions can reach desktop agents in the customer's tenant, whether approval prompts can be clicked by page scripts, and whether endpoint telemetry records agent-launched processes and package installs. Pair this with extension allow-listing and enterprise SSO that blocks personal accounts. Treat the researcher's Cowork and Remote Control claims as hypotheses to test, not established facts.","delivery":"Delivery framing: turn the finding into a short hardening checklist owned by endpoint security with the AI program office. Inventory Claude accounts on managed devices, disable cross-device features without a business need, put browser extensions under change control, and alert on unexpected agent-initiated package installs or outbound connections. Re-check status when Anthropic publishes Dispatch retirement or remediation details, and record exceptions with named approvers."},"roleDetails":{"sales":{"customerProblem":"Agencies and campuses adopting Claude Desktop lack visibility into personal accounts, cross-device features and extensions that could let a browser compromise reach a managed endpoint.","stakeholders":["CISO / endpoint security lead","AI program or innovation office","Desktop engineering / MDM team","Procurement and contract manager"],"discoveryQuestions":["Are staff allowed to sign in to personal Claude accounts on managed devices?","Which Claude Desktop features (Cowork, Code, Dispatch, Remote Control) are enabled and for whom?","Do you allow-list browser extensions on managed browsers?","Does endpoint telemetry attribute processes launched by AI agents?"],"valueHypothesis":"A bounded review of Claude agent surfaces can reduce exposure from unmanaged accounts and extensions before wider Desktop rollout.","potentialEngagement":"Two-to-three-week agent-surface and account inventory with a hardening checklist for Claude Desktop deployments.","unsupportedClaims":["That government or enterprise tenants are vulnerable","That Cowork or Remote Control are exploitable (not demonstrated in this post)","That disabling Dispatch eliminates the risk","Any quantified risk reduction"]},"engineering":{"fit":"Fits any customer piloting Claude Desktop with agentic features on managed endpoints.","architectureIntegration":"Integrate Claude tenant SSO and seat controls with MDM, browser-extension management and EDR so agent-launched activity is attributable.","prerequisites":["Enterprise or government Claude tenant with SSO","MDM control of Claude Desktop configuration","Managed browser with extension policy","EDR or process telemetry on endpoints"],"constraints":["Test only in a lab tenant; do not reproduce exploits on production endpoints","Feature availability varies by plan and tenant","Researcher's cross-machine path not demonstrated"],"security":"Block personal accounts on regulated endpoints, disable unneeded cross-device features, require approvals outside page-scriptable UI where possible, and monitor agent package installs and egress.","proofOfValue":["Confirm in a lab whether a web session can reach desktop agent sessions in the customer's tenant","Verify extension allow-listing blocks script injection on claude.ai","Show EDR alerts on an agent-initiated global package install"]},"delivery":{"work":"Inventory accounts and enabled features, apply configuration baselines, govern extensions and add agent-activity alerting.","dependencies":["Identity team for SSO and personal-account blocking","Endpoint/MDM team","Security operations for alert tuning","Anthropic status on Dispatch retirement"],"ownership":"Endpoint security, with the AI program office as policy co-owner.","skillsAdoption":"Brief admins and help desk on why personal accounts and cross-device features are restricted; train SOC on agent-attributed telemetry.","governanceCheckpoints":["Security sign-off before enabling Cowork or Code for new groups","Quarterly review of extension allow-list","Exception register for cross-device features"],"acceptanceCriteria":["Proposed: zero personal Claude accounts detected on managed devices at re-scan","Proposed: cross-device features disabled for all groups without documented need","Proposed: test alert fires for an agent-initiated package install"],"risks":["Anthropic changes feature behavior without notice","Shadow use moves to unmanaged devices","Over-restriction slows legitimate pilots"]}},"retrievedAt":"2026-11-08T04:04:28Z","enrichedAt":"2026-11-08T04:08:54Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Staff who use personal accounts for convenience need a sanctioned alternative; restrictions should come with enterprise access and training.","procurementImplications":"Ask vendors for documentation of which surfaces can control local agents, approval-channel design and disclosure/remediation timelines; consider contract terms for security-advisory notice.","operatingModelImplications":"AI agent governance becomes part of endpoint security operations rather than a standalone AI policy.","sourceVerification":{"openedUrl":"https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce/","referenceExcerpt":"an authenticated web session is not, by itself, evidence that the user authorized a command on their machine","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}