This is a researcher's proof of concept. The reporting describes no in-the-wild exploitation. The technical report and video behind it were not available to us, so the exploit details below are Weizman's claims as relayed by The Register. We did not reproduce them.
What was reported
The Register says Weizman disclosed the issue in May. Anthropic did not pay a bug bounty or issue a CVE, but told him it planned to retire Dispatch at the end of October. The Register reports that Anthropic accepted the report as valid but closed it as a duplicate of a flaw it was already tracking. It also says Anthropic did not answer questions about when it would retire the feature. We found no Anthropic statement responding to the specific allegation.
Dispatch had not been retired as of publication. Anthropic's support page describes it as a limited beta on some Pro, Max, and Ultra plans and says it isn't available to new users. The page also says existing users can keep using it "for now." That page is live and marked as recently updated, so it may not match its wording on October 30 exactly.
How the attack is said to work
The prerequisites are real and limit the risk:
- A browser extension with access to claude.ai must be present.
- The user must be authenticated to Claude on the web and to Claude Desktop with Dispatch enabled.
- Weizman says Cowork and Claude Code remote-controlled session discovery reduce the need for Dispatch specifically.
He argues the extension requirement is easy to meet. An attacker could trick someone into installing a malicious extension, but hijacking a legitimate one is usually easier. He cites supply-chain compromise and a black market for buying legitimate extensions.
The reported chain, as I read it:
- The extension injects a content script into claude.ai's main JavaScript world. That script shares the page's context and the user's session cookies.
- The script opens the Dispatch page in a tiny, unfocused popup. Weizman called this the only visible trace of the attack.
- The script calls a sessions endpoint filtered for local Dispatch agents. Weizman says this returns the session ID of the Claude Desktop agent on the user's machine.
- The script "force prompts" by typing instructions into the composer. In the demo these were plausible requests, such as listing work folders and then installing an npm package through Claude Code.
- Claude asks for approval before acting, so the researchers clicked "Allow" once per second to keep the chain moving without a human watching.
- The script repeats, rephrasing and insisting, until code runs. In Weizman's words, the researchers see it as "when, not if."
The demo payload was a global npm install of a package whose preinstall hook opened the calculator. That shows code execution but nothing worse. Weizman and The Register say real malware could steal source code and cloud credentials or install a backdoor. Those are possible outcomes, not demonstrated ones.
Why enterprise admins should care
Dispatch is designed to work across machines. If a compromised browser session can reach a connected desktop on another computer, the browser becomes a remote entry point. The risk grows when one account is used on both home and work machines. In that case Dispatch can bridge from an employee's personal Claude account in a browser to Claude Desktop on a work laptop.
Forever Security shared account counts from six customer organizations, which Weizman called a "small subset." Personal accounts made up 18% to 71% of known Claude accounts:
| Organization | Known Claude accounts | Personal accounts |
|---|---|---|
| Lowest share | 1,233 | 255 (18%) |
| Second example | 695 | 214 (31%) |
| Highest share | 28 | 20 (71%) |
The other three organizations fell between 30% and 44%. This is a vendor's customer sample. It does not show how common the pattern is across businesses.
Be careful with the scale figures too. Weizman's "millions of installs" line is his own estimate. Anthropic's Cowork data covers 1.2 million sampled sessions from more than 600,000 organizations in May. Anthropic says the sample is rate-capped and not a measure of total usage. The roughly 950 million monthly visits to claude.ai is site traffic. Neither figure counts users who enabled Dispatch or were exposed.
Anthropic's own warning
Anthropic's documentation is blunt about the design. Dispatch chains a remote interface to a desktop agent, and the help page says the chain can trigger real actions. It lists reading, moving or deleting local files, interacting with connected services, controlling a browser, and using desktop apps. It warns that a manipulated instruction could cascade into actions that are hard or impossible to undo. It tells users to understand what is accessible and to know how to disconnect or revoke access quickly.
So the vendor doesn't dispute that the agent is powerful. The disagreement is over whether the web surface should get the same authority as the paired phone.
The proposed fix and the counterargument
Weizman's suggested remediation is to treat the web version as a separate device with weaker permissions. A phone instructing a desktop agent makes sense to him, but a browser session shouldn't be able to run commands or take other out-of-scope actions. He says OpenAI's Codex avoids the problem because web sessions can't see or interact with desktop-started sessions.
A fair counterpoint is that shared sessions are a headline feature. Anthropic's pitch is one continuous thread across phone and desktop. Restricting web access would cost convenience. It is also true that a malicious extension is already a serious compromise. The reported novelty is that it escapes the browser boundary and reaches the host or another machine. That is a design-level concern, not just a bug.
This also fits a pattern in Forever Security's recent work. The Register reported on October 29 that the firm found embedded-browser flaws in five AI developer tools, including Claude Desktop, with some vendor responses disputed. Weizman's broader theme is that agentic tools create their own threat model on top of the traditional one.
What to do now
The evidence reviewed shows no vendor workaround, no affected-version range, no CVE, and no way to detect past use. These steps are my judgment from the reported attack conditions, not Anthropic guidance:
- Inventory browser extensions. Look for extensions with permission to run on claude.ai. Remove any that aren't essential, especially ones with broad site access.
- Separate personal and work Claude accounts. Avoid signing a personal account into Claude Desktop on a managed laptop.
- Check whether Dispatch or Cowork remote features are enabled. Turn off any that users don't need. Harmonic Security's practitioner guide says it observed Dispatch on a Team plan on September 10 despite documentation saying otherwise. It also says no admin toggle is documented, so don't assume policy covers it.
- Treat approval prompts as a security control. The reported demo auto-clicked "Allow," so a human-approval gate alone is a weak defense against this chain.
- Watch for unexpected npm installs or Claude Code sessions on developer machines. Anyone who suspects exposure should rotate cloud credentials, since source code and cloud keys are the likely targets.
Don't assume Dispatch has been withdrawn. Anthropic's page says existing users can keep using it for now.
Bottom line
ThisBash is a credible, researcher-demonstrated route from a compromised browser extension to code execution through an AI desktop agent. It needs a prior foothold and has no reported real-world exploitation. The unresolved question is whether Anthropic will limit web-originated control of desktop agents or leave that design in place.