A browser extension should not be able to run commands on a laptop. Forever Security found a route through Dispatch, a Claude feature for sending phone tasks to Claude Desktop.
What the researchers made Claude do
The chain needs an extension able to run scripts on claude.ai, plus a person signed into the site and Claude Desktop with Dispatch on. Dispatch also accepted an ordinary signed-in web session, though the page showed no link.
In the test, a script opened Dispatch and sent Claude four prompts in the user’s voice asking it to install an npm package. Claude balked at the unfamiliar name; a follow-up pushed it through. Approval prompts appeared in the page the extension controlled, so a loop clicking “Allow” every second removed any human decision. The package’s install script then opened Calculator. The same access could have taken files or planted a backdoor.
Personal accounts on work machines
Dispatch links devices, so the reach does not stop at one computer. A personal Claude account on a work laptop gives a compromised home browser a route onto a corporate endpoint, next to source code and cloud credentials.
The flaw was reported on May 14, accepted six days later, then closed as a duplicate of something Anthropic had already found. The company said Dispatch would be retired around the end of October, and it is now closed to new users, though the help page says nothing about a retirement.
Retiring a feature is not fixing a design
The researchers argue the pattern survives Dispatch. Claude Code Remote Control and Claude Cowork both let the web drive a local agent, so retiring one feature does not close the boundary.
Defenders should switch off cross-device Dispatch where unneeded, review how paired devices are approved and watch for surprise installs.
