From the Anthropic edition of November 7, 2026
Forever Security: a browser extension on claude.ai could drive Claude Dispatch to run code through Claude Desktop, even on another machine signed in to the same account
Forever Security · Cross-sector endpoint security (applies to agencies and campuses running Claude Desktop) · Global; researcher observations from customer environments
- Publisher
- Forever Security blog
- Original publication
- 2026-11-04
- Source retrieved
- 2026-11-08
What happened
Source finding: researcher Gal Weizman reports that Claude Dispatch's interface and API were reachable from an ordinary logged-in claude.ai session, so an extension able to script claude.ai could send prompts to Claude Desktop as the user. In the proof of concept, four prompts plus a script that clicked 'Allow' every second got Claude to run a global npm install whose preinstall hook opened Calculator. Disclosure timeline per the researcher: reported May 14, 2026; Anthropic acknowledged validity May 19 and closed it as a duplicate of an internally known issue; on Oct 13 Anthropic said Dispatch would be retired, targeting end of October 2026. Researcher claim (not demonstrated in this write-up): Claude Code Remote Control and Cowork sessions allow the same attack. The firm says it has seen personal Claude accounts with cross-device Dispatch enabled on corporate endpoints. Why now: published Nov 4 and reported Nov 5-6; not previously archived.
Why it matters
Directly relevant to state agencies, local governments, school districts and universities that deploy Claude Desktop, Cowork or Claude Code, or that tolerate staff signing in to personal Claude accounts on managed devices. The attack path crosses from a home browser to a work laptop when one personal account spans both. The write-up did not test Claude for Government or enterprise tenants, so applicability to managed tenants is unverified.
Evidence and measured results
Single-researcher proof of concept with published code steps; same-machine execution demonstrated; cross-machine path described but not shown in the write-up. No real-world exploitation reported. No CVE or Anthropic public advisory found during this run. Personal-account observations are vendor-reported from unnamed customers.
Limitations and uncertainty
Vendor research published alongside product marketing; claims about Remote Control and Cowork are untested in this post; Anthropic's current position and any fix after Oct 30 were not confirmed. Feature availability differs by plan and tenant.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-08; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies and campuses adopting Claude Desktop lack visibility into personal accounts, cross-device features and extensions that could let a browser compromise reach a managed endpoint.
- Stakeholders
- CISO / endpoint security lead
- AI program or innovation office
- Desktop engineering / MDM team
- Procurement and contract manager
- Discovery questions
- Are staff allowed to sign in to personal Claude accounts on managed devices?
- Which Claude Desktop features (Cowork, Code, Dispatch, Remote Control) are enabled and for whom?
- Do you allow-list browser extensions on managed browsers?
- Does endpoint telemetry attribute processes launched by AI agents?
- Value hypothesis
- A bounded review of Claude agent surfaces can reduce exposure from unmanaged accounts and extensions before wider Desktop rollout.
- Potential engagement
- Two-to-three-week agent-surface and account inventory with a hardening checklist for Claude Desktop deployments.
- Unsupported claims
- That government or enterprise tenants are vulnerable
- That Cowork or Remote Control are exploitable (not demonstrated in this post)
- That disabling Dispatch eliminates the risk
- Any quantified risk reduction
Pre-sales engineering
Role takeaway
- Fit
- Fits any customer piloting Claude Desktop with agentic features on managed endpoints.
- Architecture and integration
- Integrate Claude tenant SSO and seat controls with MDM, browser-extension management and EDR so agent-launched activity is attributable.
- Prerequisites
- Enterprise or government Claude tenant with SSO
- MDM control of Claude Desktop configuration
- Managed browser with extension policy
- EDR or process telemetry on endpoints
- Constraints
- Test only in a lab tenant; do not reproduce exploits on production endpoints
- Feature availability varies by plan and tenant
- Researcher's cross-machine path not demonstrated
- Security
- Block personal accounts on regulated endpoints, disable unneeded cross-device features, require approvals outside page-scriptable UI where possible, and monitor agent package installs and egress.
- Proof of value
- Confirm in a lab whether a web session can reach desktop agent sessions in the customer's tenant
- Verify extension allow-listing blocks script injection on claude.ai
- Show EDR alerts on an agent-initiated global package install
Delivery
Role takeaway
- Work
- Inventory accounts and enabled features, apply configuration baselines, govern extensions and add agent-activity alerting.
- Dependencies
- Identity team for SSO and personal-account blocking
- Endpoint/MDM team
- Security operations for alert tuning
- Anthropic status on Dispatch retirement
- Ownership
- Endpoint security, with the AI program office as policy co-owner.
- Skills and adoption
- Brief admins and help desk on why personal accounts and cross-device features are restricted; train SOC on agent-attributed telemetry.
- Governance checkpoints
- Security sign-off before enabling Cowork or Code for new groups
- Quarterly review of extension allow-list
- Exception register for cross-device features
- Acceptance criteria
- Proposed: zero personal Claude accounts detected on managed devices at re-scan
- Proposed: cross-device features disabled for all groups without documented need
- Proposed: test alert fires for an agent-initiated package install
- Risks
- Anthropic changes feature behavior without notice
- Shadow use moves to unmanaged devices
- Over-restriction slows legitimate pilots
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Treats an authenticated web session as authorization for local agent commands. Agencies should map which Claude surfaces (web, desktop, mobile, Code Remote Control, Cowork) can drive a local agent and whether approval prompts render in a page an extension can control.
Governance
Who approves, reviews and stays accountable for outcomes?
Supports policies that restrict Claude use on managed devices to enterprise or government tenants, disable unneeded cross-device features, and govern browser extensions as endpoint software.
Security and privacy
What data, permissions and controls need testing?
A compromised or malicious extension could cause file reads, code changes, credential theft or persistence within Claude Desktop's permissions. Approval dialogs inside an attacker-controlled page do not establish user consent.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Staff who use personal accounts for convenience need a sanctioned alternative; restrictions should come with enterprise access and training.
Procurement
What should contracts, pricing and exit terms secure?
Ask vendors for documentation of which surfaces can control local agents, approval-channel design and disclosure/remediation timelines; consider contract terms for security-advisory notice.
Operating model
Which teams own the service once it runs?
AI agent governance becomes part of endpoint security operations rather than a standalone AI policy.
Publication history
- 2026-11-07Anthropic · Issue 106 resources
Stable resource ID: forever-security-thisbash-claude-dispatch-extension-rce-20261104