Browser extensions can hijack Claude Desktop via Dispatch feature

Security researchers at Forever Security have demonstrated a critical vulnerability in Anthropic’s Claude ecosystem that allows browser extensions to execute arbitrary code on a user’s computer. The attack exploits the Dispatch feature, which links the web interface of claude.ai with the local Claude Desktop application, effectively bypassing standard browser sandbox protections. Although Anthropic has indicated plans to retire Dispatch by the end of October 2026, the flaw remains exploitable for existing users.

What happened

The vulnerability centers on how Claude Desktop accepts instructions from the web interface. Researchers found that Dispatch accepted commands from an ordinary signed-in session on claude.ai, even though the website provided no visible link or indication that it was connected to the desktop agent. This design allowed any script running within the browser context of claude.ai—such as those injected by a browser extension—to send tasks directly to the locally installed AI agent.

In a controlled test, researcher Gal Weizman showed that a malicious extension could prompt Claude Desktop to install an npm package. While the AI agent initially hesitated due to the unfamiliar package, the script automated the approval process by clicking "Allow" buttons as they appeared on the web page. Once approved, Claude executed a global installation, triggering a script that opened the Calculator app. This proof of concept confirmed that the AI agent could be coerced into performing actions with the same permissions as the user, potentially leading to file theft or backdoor installation.

The attack does not require a browser exploit or complex technical setup beyond a compromised or malicious extension. It relies entirely on the trust relationship between the web session and the desktop application. The researchers noted that while their test occurred on a single machine, the architecture of Dispatch could theoretically allow an extension on one device to target Claude Desktop on another, provided both are signed into the same account with cross-device features enabled.

Key details

• Attack vector: A browser extension with script execution rights on claude.ai sends commands to Claude Desktop via the Dispatch feature.
• Prerequisites: The victim must be signed into both claude.ai and Claude Desktop with Dispatch enabled; the desktop app must be open and the computer awake.
• Automation: The attack script automatically clicks approval prompts in the browser, removing the need for user interaction during the exploit.
• Scope: The flaw affects Pro, Max, and Ultra plan users who have access to Dispatch; new users are currently blocked from enabling it.
• Vendor response: Anthropic accepted the report on May 19, 2026, but closed it as a duplicate of an internal finding; Dispatch is scheduled for retirement in late October 2026.
• Future risk: Researchers warn that similar vulnerabilities may exist in Claude Code Remote Control and Claude Cowork sessions, though these were not tested.

Background

Claude Desktop is an AI agent designed to operate locally on a user’s machine, granting it the ability to read files, run commands, and interact with the operating system. To enhance usability, Anthropic introduced Dispatch, a feature allowing users to send tasks from their mobile or web interfaces to their desktop agent. This creates a bridge between the cloud-based web service and the local executable.

Browser extensions typically operate within a sandboxed environment, restricted from accessing the local file system or executing system commands directly. However, when an extension can manipulate the content of a trusted website like claude.ai, it can leverage that site’s authorized connections to other services. In this case, the web interface acts as a proxy, translating malicious script inputs into legitimate-looking commands for the desktop agent, which then executes them with full user privileges.

Why it matters

For teams that rely on AI agents for development or administrative tasks, this incident highlights the risks of blending web-based convenience with local system access. Many developers use personal AI accounts on work machines, often enabling cross-device features for seamless workflow transitions. If a personal account is compromised via a browser extension, it could provide an attacker with a direct pathway to execute code on corporate hardware, bypassing traditional endpoint security measures that monitor for direct malware execution.

The reliance on automated approvals further exacerbates the risk. AI agents are designed to ask for confirmation before performing sensitive actions, but if the interface displaying those prompts is controlled by a malicious script, the safety mechanism becomes ineffective. This underscores the need for stricter controls over which applications and extensions have access to AI-driven workflows, particularly those with system-level permissions.

Additionally, the planned retirement of Dispatch does not immediately resolve the risk for current users, nor does it address the underlying design pattern that may persist in other features like Claude Cowork. Organizations must assume that similar bridging mechanisms in other AI tools could present comparable vulnerabilities, requiring a proactive approach to monitoring AI agent activity rather than relying solely on vendor patches.

What you can do

• Disable cross-device Dispatch immediately if it is not essential for your workflow, and review paired devices to revoke access for any unrecognized endpoints.
• Audit all browser extensions installed on machines where Claude Desktop is used, removing any that are unnecessary or have broad permissions on claude.ai.
• Monitor system logs and AI agent history for unexpected package installations, credential access attempts, or unusual external connections initiated by the AI.
• Avoid using personal AI accounts on work computers, especially if those accounts have cross-device synchronization enabled with home machines.
• Keep Claude Desktop updated and stay informed about Anthropic’s announcements regarding the retirement of Dispatch and the status of replacement features.
• Treat AI agent approvals with the same scrutiny as administrative sudo commands, ensuring that no automated scripts can intercept or bypass manual confirmation steps.