- Forever Security says an extension that controls claude.ai could use Claude Dispatch to make Claude Desktop run code, even on another computer on the same account.
- The researchers argue a logged-in web session does not prove the user approved a command on their machine. Anthropic is retiring Dispatch, but they say similar features remain.
- Ask which AI desktop agents run on managed laptops, whether personal accounts are signed in, and which extensions can reach AI sites.
Most companies treat a browser extension as a risk to what happens inside the browser. New research argues that AI assistants change that. When an assistant links a website to a desktop agent, a web login can start to carry the power to run commands.
The security firm Forever Security published the work on November 5. It calls the attack ThisBash. The research centres on Claude Dispatch, a feature from Anthropic.
What the researchers found
Dispatch lets people send instructions from a phone or another device to Claude Desktop. On the desktop, an agent can open local files and carry out commands. Forever Security says the direct link between the phone app and the desktop app had no flaws.
The weak point was the browser. Claude Desktop is built with Electron, a toolkit for making desktop apps from web technology. The researchers say it reuses most of the interface and API behind claude.ai. The web version did not show a link to Dispatch. But hiding the link did not restrict access, they say. Anyone who copied the address from the desktop app could open Dispatch in a normal logged-in browser tab.
That means an extension with permission to act on claude.ai could do the same, using the user's own session.
How the attack works
The researchers describe a chain with no browser exploit. A content script on claude.ai opens the Dispatch page in a 200 by 200 pixel popup. It then asks for the session tagged cowork-dispatch-local, using the user's cookies. The reply identifies the Claude Desktop agent on the user's machine.
Next, the script types prompts and waits for each answer. A one-second timer clicks any Allow button that appears. The script reads Claude's replies and adjusts what it says next.
The team calls this "prompt forcing". It is not a single hidden instruction hoping to work. It is a sustained conversation in which the attacker holds the user's voice.
In the proof of concept, the researchers used four handwritten prompts and automated clicks. Claude first hesitated to install an unfamiliar package. A follow-up prompt, written in the user's voice, reassured it, and the install went ahead. The package's preinstall script opened Calculator.
Calculator was only a demonstration. The researchers say the same hook could copy files or add a backdoor. That is their assessment. The source describes no attack on real victims.
Why a personal account matters at work
Dispatch connects devices, so the desktop that receives the commands can be a different computer from the browser. Forever Security sketches a plain case. Picture an employee who is signed in to a personal Claude account on a home browser. The same account is also used in Claude Desktop on a work laptop. If Dispatch is enabled and the work desktop is reachable, an extension on the home browser could become a way into the managed workstation.
Forever Security also says it has seen this setup in the field. Its customers' corporate endpoints included personal Claude accounts with Dispatch enabled across devices. It does not say how many.
Extensions are common. LayerX's 2025 Browser Security Report, as cited by Forever Security, looked at a group of enterprise users. In that group, 99% had at least one extension installed. LayerX also found that 53% had an extension with high or critical permissions.
The idea: a login is not a signature
A keycard that opens the lobby should not open the vault. A logged-in web session works like the lobby card. It shows who you are. It does not show that you meant to run this command on this machine.
The researchers put it the same way: "an authenticated web session is not, by itself, evidence that the user authorized a command on their machine."
Anthropic is retiring Dispatch, according to the research summary. Forever Security says that does not fix the design. It argues that Claude Code Remote Control and Claude Cowork sessions would let an extension carry out the same attack. A follow-up post is planned. Those are the firm's claims. The source we reviewed does not include Anthropic's response.
Questions for your security team
The practical question is not whether one feature is removed. It is where an agent on your laptops takes its orders from.
Ask which AI desktop agents run on managed laptops. Ask whether staff sign into them with personal accounts. Ask whether device pairing across personal and corporate machines is allowed or even visible.
Ask which browser extensions can act on AI sites such as claude.ai. Then ask what an agent can do without a person approving on the device itself. An approval button inside a web page can be clicked by a script.
Forever Security's lesson is that governing extensions and governing AI agents are now one job. Any channel an attacker can control, and that an agent obeys, is a path to the machine it runs on.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: forever.security.
