Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries

Anthropic's Claude Dispatch feature has a serious security flaw that could allow attackers to execute remote commands across corporate networks without needing to exploit a browser. This vulnerability was discovered by Forever Security researcher Gal Weizman and disclosed to Anthropic in May, but the company has not taken any action to address it. Dispatch is a feature that allows users to send and manage tasks from their mobile device or browser to Claude Desktop, an AI agent that runs commands on their computer.

The flaw exists because Claude Dispatch's interface and API are reachable from a normal web session on claude.ai. This means a malicious browser extension could send commands to Claude Desktop as if they were coming from a legitimate Dispatch user. Once the extension gains access to the files on the operating system, it can execute arbitrary code and potentially compromise the entire machine.

The vulnerability, dubbed "ThisBash," allows attackers to perform a classic escalation of privileges. Anthropic acknowledged Weizman's report in May, but closed the security issue as a duplicate of a known flaw it was already tracking. Despite this, Dispatch remains available in limited beta for certain plans as of October 30.

Even if Anthropic eventually retires Dispatch, the fundamental flaw in Claude's design would still exist in other features like Claude Code Remote Control and Claude Cowork sessions. Weizman has communicated all of this to Anthropic, but the company has still decided not to take any action.

The attack requires a browser extension with access to claude.ai, which can be achieved either by installing a malicious extension or by hijacking a legitimate one. The attack sequence involves registering a MAIN-world content script, opening Dispatch in a popup, initiating "force prompting" with the AI agent, and using a series of prompts to trick the agent into executing malicious commands.