A cybersecurity company, Forever Security, says it found a way for a browser add-on, also called an extension, to give orders to Claude Desktop. In that Anthropic app, Claude works as an AI agent, which Anthropic says can use a person's files and apps to carry out tasks on their computer. The route runs through Dispatch, a Claude feature that lets people send work from their phone to Claude Desktop. The firm calls the attack ThisBash. It says the flaw, a weakness an attacker could use, turns an add-on's access to one website into the power to run programs on the computer itself.
The firm says Dispatch appeared to work only through Claude's apps, but its controls also worked from a person's own signed-in session on the Claude website. So an add-on allowed to act on that website could open Dispatch in a tiny pop-up window, which the firm says is the only visible sign of the attack, and send Claude requests as though they came from the user. Claude asks before it acts, so the firm's test add-on clicked every "Allow" button as it appeared. When Claude hesitated to install an unfamiliar package of code, the firm says, a follow-up message it wrote in the user's voice reassured Claude, and the installation went ahead.
In the firm's demonstration, the package only opened the Calculator app. But the firm says that, depending on what Claude can reach on the computer, an attacker could use the same path to read source code, secret digital keys, stored passwords and other files, or to install software that keeps running after a restart. Because Dispatch links devices, the computer with the add-on and the computer that runs the commands need not be the same. The firm describes a person who uses a personal Claude account both in a browser at home and in Claude Desktop on a work laptop: an add-on at home could become a way into the work computer. It says it has seen personal Claude accounts with Dispatch set up on company computers at its customers.
The attack needs an add-on with access to the Claude website. The firm says an attacker could get one there by having a harmful add-on installed, by tampering with an update, or through a flaw in an otherwise legitimate add-on. According to a news report, the user must also be signed in to both the Claude website and Claude Desktop with Dispatch turned on. The firm advises companies to turn off sending tasks between devices where no one needs it, and to vet add-ons' permissions like any other software on their computers.
Forever Security says it reported the flaw to Anthropic on May 14, and that on May 19 Anthropic confirmed the flaw was real but closed the report because it had already found the same problem itself. On Oct. 13, the firm says, Anthropic said it would retire Dispatch, aiming for the end of October. Anthropic's help page now says Dispatch is in a limited test on some of Claude's paid Pro, Max and Ultra plans and isn't open to new users, but people who already use it "can keep using it for now." The page gives no date for switching it off. According to a news report, Anthropic did not answer a reporter's questions, including when it planned to retire the feature.
The firm says retiring Dispatch would not end the problem. It says add-ons can carry out the same attack through Claude Code Remote Control and Claude Cowork sessions, two other features that let the Claude website direct Claude on a person's computer. It says it will publish more on those in a later post.