ThisBash: a browser extension with access to claude.ai can make Claude Desktop run code through Dispatch

On November 4, 2026, Forever Security researcher Gal Weizman published ThisBash, a flaw in Claude Dispatch, the feature that lets you hand tasks to Claude Desktop from your phone or the web. Weizman found that Dispatch can be driven from an ordinary signed-in claude.ai browser session, so any browser extension allowed to run scripts on claude.ai can send instructions that look as if the account owner typed them. Claude Desktop can run commands on the computer where it is installed, which turns that access into code execution. No CVE or severity rating has been assigned.

The attack needs a browser extension that can script claude.ai: a malicious one, a legitimate one with a hijacked update, or one with its own bug. The victim must be signed in to claude.ai and Claude Desktop with Dispatch enabled, and the desktop app must be open on an awake computer. No browser exploit is involved. The proof of concept clicks Claude's Allow prompts by itself, leaves only a small unfocused popup on screen, and had Claude install an npm package whose install script opened Calculator. The researchers say a Claude Desktop on another computer linked to the same account could be reached too, such as a work laptop signed in to a personal account, but they describe that path rather than demonstrate it.

Weizman reported the flaw on May 14. Anthropic accepted it as valid on May 19 but closed it as a duplicate of an issue it had already found internally, and on October 13 it told the researchers Dispatch would be retired, targeting the end of October. As of November 6, Anthropic's help page still describes Dispatch as a limited beta that is closed to new users but available to existing ones, with no retirement notice, and we found no Anthropic advisory or public statement. Weizman argues the same design exposes Claude Cowork and Claude Code Remote Control sessions; press reports say those products were not tested separately.