Anthropic has known about a privilege escalation in Claude Dispatch since May and has left the hole open.
Gal Weizman, a researcher at Forever Security, discovered that the Dispatch interface and API answered requests from any ordinary authenticated session on the claude.ai website. Dispatch is the bridge that forwards tasks from a phone or browser to Claude Desktop, the agent that executes commands on a user’s machine. Practically, a browser extension controlling claude.ai could reach it with the authority of a signed-in Dispatch customer, needing no browser exploit and almost no interaction. Weizman calls the flaw ThisBash.
Anthropic confirmed the report, closed the ticket as a duplicate of work already in progress, paid no bounty, issued no CVE and told him Dispatch would retire at the end of October. As of October 30 the support page still listed it in limited beta.
The flaw outlived the feature
Retiring one feature would not fix the design. Weizman said the same reach applies to Claude Code Remote Control and Cowork, both exposed through the web client and both sharing state with the desktop app. A hijacked extension can ask Cowork to open a file, install a malicious npm package or run code, and it will.
Getting an extension is the easy step. Attackers hijack legitimate ones through supply chain compromise or simply buy them on a secondary market.
What security teams should weigh
The enterprise question is broader than any one vendor. Agentic desktop clients deliberately hold operating system access, and every web surface able to command them inherits that reach. Inventory which extensions can reach AI consoles, and treat the host as shared with every extension loaded in that browser profile.
