From the Anthropic edition of November 7, 2026
The Register: Anthropic has not closed the Claude Dispatch flaw and did not answer questions; researcher data show 18%-71% personal Claude accounts in six organizations
The Register (reporting on Forever Security research) · Cross-sector endpoint security · Global
- Publisher
- The Register
- Original publication
- 2026-11-05 13:00 UTC
- Source retrieved
- 2026-11-08
What happened
Source finding: The Register reports Anthropic did not respond to its questions, including on when Dispatch would be retired, and that as of October 30 Claude's support page listed Dispatch as limited beta on some Pro, Max and Ultra plans and closed to new users. Researcher-supplied figures: in six customer organizations personal Claude accounts in corporate environments ranged from 18% to 71% (e.g., 255 of 1,233; 214 of 695; 20 of 28). Researcher claim: OpenAI's Codex does not share web and desktop sessions, avoiding this pattern (not independently tested; noted only as the researcher's comparison). Why now: published Nov 5; not previously archived; adds Anthropic's non-response and account-mix data beyond the primary write-up.
Why it matters
The personal-account share is the most transferable signal for public agencies and campuses: shadow Claude accounts on managed devices create the bridge the attack needs. Relevant to CIO and CISO decisions on whether to standardize on a government or enterprise Claude tenant before broad use.
Evidence and measured results
Journalistic account of an exclusive briefing; account percentages come from the security vendor's customer data (six organizations, described as a small subset) and were not independently verified. Anthropic did not comment.
Limitations and uncertainty
Small, non-representative private-sector sample; no public-sector organizations identified; Anthropic's side absent; status may change after publication.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-08; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Organizations do not know how many staff use personal Claude accounts on managed devices, the precondition for cross-device attacks.
- Stakeholders
- CIO
- CISO
- Identity and access management lead
- Department AI champions
- Discovery questions
- Can you distinguish personal from tenant Claude sign-ins today?
- Is there a sanctioned Claude tenant staff can move to?
- Who tracks vendor security disclosures for AI tools in use?
- Value hypothesis
- Measuring and consolidating Claude accounts lowers unmanaged exposure and improves license visibility.
- Potential engagement
- Shadow AI account baseline and tenant-consolidation plan for Claude users.
- Unsupported claims
- That public agencies have 18%-71% personal accounts
- That Anthropic has refused to fix the issue permanently
- That another vendor's product is safer
Pre-sales engineering
Role takeaway
- Fit
- Useful wherever SSO, gateway or CASB telemetry can see Claude sign-ins.
- Architecture and integration
- Use identity-provider and secure web gateway tenant restrictions to permit only the organization's Claude tenant on managed devices.
- Prerequisites
- Identity provider with Claude SSO
- Gateway or CASB visibility into claude.ai traffic
- Endpoint inventory
- Constraints
- Privacy and labor-relations limits on monitoring staff use
- Gateway decryption policies vary by jurisdiction
- Security
- Enforce tenant restrictions, log sign-in types, and alert on personal-account use on regulated systems.
- Proof of value
- Produce a count of personal vs tenant Claude accounts on managed devices
- Demonstrate a tenant-restriction policy blocking a personal sign-in in a pilot group
Delivery
Role takeaway
- Work
- Baseline, notify, migrate and enforce tenant-only Claude use on managed devices.
- Dependencies
- Identity team
- Network/gateway team
- HR or labor relations for communications
- License budget for enterprise seats
- Ownership
- Identity and access management, with CISO oversight.
- Skills and adoption
- Plain-language notice explaining why personal accounts are being blocked and how to request a sanctioned seat.
- Governance checkpoints
- Communications reviewed with HR before enforcement
- Exception approvals by data owner
- Monthly status review of vendor disclosures
- Acceptance criteria
- Proposed: baseline count completed for all managed devices
- Proposed: personal Claude sign-ins on managed devices reduced to documented exceptions within an agreed window
- Risks
- User backlash or shift to unmanaged devices
- Incomplete telemetry undercounts accounts
- Vendor status changes
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Supports identity-level controls: tenant restrictions and SSO enforcement that keep personal Claude accounts off managed devices.
Governance
Who approves, reviews and stays accountable for outcomes?
Agencies should track vendor disclosure status and require timely remediation communication for agent features in use.
Security and privacy
What data, permissions and controls need testing?
Mixed personal and corporate account use expands the attack surface beyond the managed environment.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Migration plans should preserve access for staff who rely on Claude for accessibility or workload reasons by providing sanctioned seats.
Procurement
What should contracts, pricing and exit terms secure?
Enterprise tenant pricing (e.g., OneGov or state agreements) can be weighed against shadow-account risk; require security notification clauses.
Operating model
Which teams own the service once it runs?
Shadow-AI measurement becomes a recurring identity operations task.
Publication history
- 2026-11-07Anthropic · Issue 106 resources
Stable resource ID: register-claude-dispatch-thisbash-no-fix-personal-accounts-20261105