---
title: "Claude Dispatch: Extensions Can Drive the Desktop Agent"
url: https://erroneo.us/security/briefs/claude-dispatch-browser-extension-agent-hijack/
description: "Forever Security shows an extension with claude.ai access can send tasks to Claude Desktop via Dispatch and run code. No fix; Dispatch is closed to new users."
type: security-brief
section: "Security Digest"
date_published: 2026-11-04
date_modified: 2026-11-06
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: []
severity: "medium"
exploited: "public-poc"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Claude Dispatch: Extensions Can Drive the Desktop Agent

**Verdict: Check exposure.** This matters only if you use Dispatch and run extensions that can script claude.ai; if so, unpair Dispatch or trim those extensions, and everyone else can treat this as a reminder that browser extensions now sit one step from a local agent.

- **Who must act:** Existing Dispatch users on Pro, Max or Ultra plans with Claude Desktop paired, especially on work machines, who run browser extensions that have access to claude.ai or to all sites.
- **Who can relax:** People who never enabled Dispatch, which includes all new users since it is closed to them, and people who run no extensions with access to claude.ai.
- **Affected:** Claude Dispatch with Claude Desktop paired, while the desktop app is open (per Forever Security, as of Nov 4, 2026); Claude Code Remote Control and Cowork sessions: claimed by the researchers but untested
- **Fixed:** No fix announced as of Nov 6, 2026; Anthropic reportedly plans to retire Dispatch
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Public proof-of-concept

## What to do

1. If you use Dispatch and do not need it, disconnect it and revoke the paired desktop; Anthropic's help page advises knowing how to quickly disconnect or revoke access.
2. Audit browser extensions in the profile you use for claude.ai and remove any with scripting access to claude.ai or to all sites that you do not fully trust.
3. Use a separate browser profile with no extensions for claude.ai if you keep Dispatch or other remote agent features enabled.
4. In managed fleets, use browser policy to restrict which extensions can run on claude.ai and on other AI tool domains.
5. Do not use a personal Claude account with Dispatch on a work laptop.

### How to check if you are affected

- Review recent Dispatch and Cowork task history in Claude Desktop for tasks you did not send.
- Look for unexpected global package installs (npm ls -g --depth=0) and new or changed files around the times the desktop app was open.
- List extensions with broad host permissions in chrome://extensions (Details, Site access) or your browser's equivalent, and check when they were last updated.

## What happened

On November 4, 2026, Gal Weizman of endpoint security company Forever Security [published research](https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce) showing that a browser extension can use Claude Dispatch to run code on a user's computer. Dispatch is the Claude feature that sends tasks from a phone to Claude Desktop, which then works on the computer as an agent. According to the researchers, the Dispatch interface and API answered an ordinary signed-in claude.ai web session, even though the website does not link to Dispatch. A request to `/v1/sessions?tags=cowork-dispatch-local` returned the ID of the paired desktop session. Anything that can script claude.ai can therefore send instructions to the desktop agent as if the user had typed them.

Their proof of concept was an extension with the `scripting` permission and access to all sites. It sent four prompts and clicked any "Allow" approval button once per second. The approval prompts appear inside the page the extension controls. Claude first hesitated to install an unfamiliar npm package, but follow-up prompts persuaded it, and the package's install script opened Calculator. No browser exploit was needed.

The researchers reported the issue to Anthropic on May 14. They say Anthropic accepted it as valid on May 19 but closed it as a duplicate of a problem it had already found internally, and on October 13 told them Dispatch would be retired, with the end of October as the target. Per the write-up, the attack still worked when it was published. Anthropic has not published an advisory as of November 6, and there is no CVE.

## Who is affected

Three conditions have to hold together. The first is an extension that can run script on claude.ai, whether malicious, legitimate but taken over through a bad update, or legitimate with its own flaw. The second is a user signed in to claude.ai. The third is Dispatch enabled with Claude Desktop paired and open. Anthropic's [help page](https://support.claude.com/en/articles/13947068-assign-tasks-from-anywhere-in-claude-cowork) says Dispatch is "in limited beta on some Pro, Max, and Ultra plans" and "isn't available to new users," and that the computer must be awake with the app open. The desktop does not have to be the same machine as the browser. Any paired desktop on the account is reachable, so a personal account on a work laptop is a path into a corporate endpoint. The researchers say Claude Code Remote Control and Cowork sessions are open to the same attack. [The Hacker News](https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html) notes they have not tested this yet, and a follow-up post is planned.

## Do you really need to act?

**Most people do not.** Dispatch is a closed beta, and the attack needs an extension that is already hostile and already has script access to claude.ai. An extension like that can read your chats anyway. What Dispatch adds is a jump from the browser sandbox to code execution on the desktop, and possibly on a different machine. That jump is the serious part, given how often extensions have been sold or hijacked to push malicious updates. If you are a Dispatch user with broad-permission extensions, or you manage machines where people might be, act this week. For everyone else, the lesson is general: once a remote agent can act on your behalf, every extension with script access to that agent's web app is part of its attack surface.

## What to do now

1. If you do not need Dispatch, disconnect it and revoke the paired desktop. The help page advises users to "know how to quickly disconnect or revoke access."
2. Check extensions: in Chrome, open `chrome://extensions` and look at "Site access" for each one. Remove or restrict any that can read and change data on all sites or on claude.ai.
3. Use a dedicated browser profile with no extensions for claude.ai if you keep Dispatch or other remote agent features on.
4. Admins can use browser policy to block extensions on claude.ai and other AI tool domains, and can keep personal Claude accounts off managed laptops.

## How to tell if you were hit

The researchers report no attacks in the wild. To check, review the task history in Claude Desktop for Dispatch or Cowork tasks you did not send. Look for unexpected global packages (`npm ls -g --depth=0`), new launch items, or changed shell profiles around times the desktop app was open. Also check whether any extension in your claude.ai profile gained new permissions in a recent update.

## Timeline

- May 14, 2026 — Forever Security reports the issue to Anthropic.
- May 19, 2026 — Anthropic accepts it as valid and closes it as a duplicate, per the researchers.
- Oct 13, 2026 — Anthropic tells the researchers Dispatch will be retired, targeting the end of October.
- Nov 4, 2026 — Research published; the researchers say it is still exploitable.
- Nov 6, 2026 — No Anthropic advisory or fix announced as of this date.

## Sources

1. [Forever Security — thisbash: Claude Dispatch browser extension RCE (Gal Weizman)](https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce)
2. [Anthropic Help Center — Assign tasks from anywhere in Claude Cowork](https://support.claude.com/en/articles/13947068-assign-tasks-from-anywhere-in-claude-cowork)
3. [The Hacker News — Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers](https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html)

---
Source page: https://erroneo.us/security/briefs/claude-dispatch-browser-extension-agent-hijack/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt