ThisBash: a browser extension can drive Claude Desktop through Dispatch, and the flaw is still open

On November 4, Gal Weizman of Forever Security published details of ThisBash, an attack in which a browser extension with access to claude.ai makes Claude Desktop run code on a computer. That computer does not have to be the one running the browser. It can be any machine signed into the same Claude account with Dispatch connected. The Register reported the research on November 5.

The bug matters less than the boundary it exposes. Browser extensions have always been able to abuse a logged-in website. Agents that accept instructions from that website give the same extension a route to the operating system. Weizman’s proof of concept was a package that opened Calculator, and neither Forever nor The Register reports exploitation in the wild. No independent reproduction has been published that we could find, and Anthropic has made no public statement on the finding.

How six steps get from a web page to a shell

Dispatch is meant to let a phone send work to Claude Desktop, which can read local files and run commands. Forever says it found no flaw in that phone-to-desktop path. The problem is that Claude Desktop is an Electron app built around much the same interface and API as claude.ai. The website simply did not link to Dispatch. Anyone with the URL could open it in a normal tab, and the service accepted requests from an ordinary authenticated web session.

The published chain runs as follows:

1. The extension registers a content script on claude.ai, giving it the page’s JavaScript context and the user’s session.
2. The script opens https://claude.ai/cowork/agent in an unfocused 200x200 popup, which Forever calls the only visible trace of the attack.
3. It calls GET /v1/sessions?tags=cowork-dispatch-local with the user’s cookies to find the Claude Desktop session.
4. It types prompts into the composer and waits for each reply.
5. A one-second timer clicks any button labeled “Allow”.
6. It reads Claude’s responses and keeps adapting until the command runs.

The demo manifest asked only for the scripting permission and broad host access. The final action was npm install -g on a package whose preinstall.js hook launched Calculator. Forever points out that the same hook could just as easily exfiltrate files, add SSH keys or install a backdoor, limited by whatever Claude can reach on that machine.

Why the guardrails and the approval button did not help

Two of the usual defenses for agents fail here, for reasons that apply well beyond this product.

The first is model-level resistance. Claude did balk at installing an unfamiliar package. Most of the hardening in this area targets indirect prompt injection, where hostile text is hidden in a document or web page and the model can be trained to distrust it. Forever calls its technique “prompt forcing”: the attacker holds the actual user channel, can read each refusal, and can answer it in the user’s voice. The final prompt in the published chain says, in effect, not to worry, because the package belongs to a friend. That was enough. A one-shot injection has to work on the first try, while a script holding the conversation can keep rephrasing.

The second is human approval. A confirmation dialog only proves consent if the attacker cannot press it. Here the Allow button was rendered in the same page the extension controlled, so a few lines of JavaScript removed the human from the loop. Any agent product that shows its approval step in a web surface reachable by extensions has this exposure, and it should treat that button as a usability feature, not a security control, unless the approval is bound to a separate trusted device or channel.

Skeptics can fairly note the prerequisite: a malicious or hijacked extension is already a serious compromise. It can read pages and act through sessions. Forever’s answer is that those powers normally stop at the browser, and this path does not. Weizman told The Register that hijacks of legitimate extensions “happen a lot,” through supply-chain compromise or purchases of existing extensions. LayerX’s 2025 browser security report, cited by Forever, found that 53% of enterprise users in its sample had extensions with high or critical permissions.

The corporate angle: personal accounts on work laptops

The cross-machine reach is what turns this from local privilege escalation into a possible initial access route. If an employee signs into a personal Claude account on a managed laptop, a compromised extension on that person’s home computer could direct the desktop agent at work, with no malicious software ever installed on the corporate endpoint beforehand.

Forever shared data with The Register from six customer organizations, which Weizman described as a small subset of its customer base. Personal accounts made up between 18% and 71% of known Claude accounts in those environments:

Organization	Personal accounts	Known Claude accounts	Share
Lowest share	255	1,233	18%
Second example	214	695	31%
Highest share	20	28	71%

The other three organizations fell between 30% and 44%. These figures come from a security vendor’s own customers, so they do not establish a population-wide rate, and a personal account on a work machine is not the same as one with Dispatch enabled. Forever does say it has seen personal accounts with cross-device dispatch enabled on corporate endpoints. Dispatch usage counts were not disclosed.

A retirement that has not arrived, and a design that may outlast it

According to Forever, it reported the issue on May 14. Anthropic acknowledged it as valid on May 19 but closed it as a duplicate of an internally known issue, and on October 13 said Dispatch would be retired, targeting the end of October. The Register says no bounty was paid and no CVE was issued, and that Anthropic did not answer its questions, including when the retirement would happen.

As of November 9, Anthropic’s help page for Dispatch still describes the feature as a limited beta on some Pro, Max and Ultra plans, closed to new users, and tells existing users they can keep using it for now. The page warns in general terms about manipulated instructions but does not mention ThisBash.

Retiring Dispatch may not close the issue. Weizman says Claude Code Remote Control and Cowork sessions, which also let the web drive a local agent, are open to the same attack, and that this reduces the need for a victim to have opted into Dispatch at all. That part of the claim is thinner: Forever’s post asserts it and promises a follow-up, but publishes the full chain only for Dispatch. It has also been a busy period for Claude’s local attack surface, including Apiiro’s report on secrets saved to public settings files by Claude Code.

Weizman’s proposed fix is to treat the web client as a separate device with lower privileges, so a command that originates on the web cannot perform actions a phone or desktop could. He contrasts this with OpenAI’s Codex, where, he says, sessions started on desktop cannot be seen or driven from the web version. The underlying trade-off is real: a session that follows you across every surface is the product’s appeal, and it is also what erases the browser’s traditional limit.

What to do and what to watch

For teams using Claude on managed machines, Forever’s practical advice is sensible regardless of how the dispute resolves: inventory which agents and accounts run on endpoints, disable cross-device features that have no business need, check whether those accounts fall under corporate SSO and identity policy, and govern browser extensions as endpoint software, including review of permission changes in updates. Individual users with Dispatch connected should audit extensions that can access claude.ai.

Three things will show how this ends: whether Anthropic actually turns Dispatch off and on what date, whether it adds device-level authorization for web-originated commands in Remote Control and Cowork, and whether Forever’s promised follow-up documents those paths with the same detail. The broader lesson for anyone building agents is already clear. A valid web session shows that a request came from an account, not that the person behind it asked for a command to run on their machine.