A browser extension able to run scripts on claude.ai used Claude Dispatch to prompt Claude Desktop on the same computer, according to a proof of concept from Forever Security. A package’s install script opened Calculator, demonstrating local code execution in that test setup. The researchers described reaching a second computer signed into the same Claude account as a possibility, but their demonstration used one computer. Forever Security’s technical report details the test.
The key security boundary was the handoff from a browser session to a desktop agent with access to local computer controls.
How the reported route reached Claude Desktop
The reported chain began with an extension that could control claude.ai and a signed-in Claude account with Dispatch enabled. The extension sent instructions through Dispatch to Claude Desktop. Forever Security described sustained interaction through the browser’s input and approval interface, rather than a single malicious prompt.
In the proof of concept, Claude Desktop installed a package whose script opened Calculator. That demonstrated local code execution under the tested setup. Researchers said they had seen no real-world attacks; this was a proof of concept, not a report of a victim’s computer being compromised.
What the proof of concept covered
The browser and Claude Desktop ran on the same computer in the demonstration. The researchers also described a possible path to another computer connected to the same Claude account, but did not demonstrate it. The reported result was opening Calculator, not documented theft of files or a corporate network compromise.
Dispatch requirements and access Anthropic describes
Anthropic’s Help Center says Dispatch requires the current Claude Desktop and Claude mobile apps, internet access on both devices, and an awake computer with Claude Desktop open. It lists Pro, Max, and Ultra plans among the requirements and describes Dispatch as a limited beta on some plans. Its page, last modified October 30, 2026, says new users cannot access Dispatch while existing users can continue using it “for now.” Anthropic’s Dispatch requirements also state that computer-use functions are unavailable in the Linux beta, although file, connector, and plugin tasks can still work there.
Anthropic describes Dispatch as able to work with desktop files, connectors, plugins, and apps. Its help page warns that these capabilities can involve reading, moving, or deleting local files, interacting with connected services, controlling a browser, and using desktop apps. Those are documented access categories; the proof of concept demonstrated a package installation that opened Calculator.
The dated statements about Dispatch
Forever Security says it reported the issue to Anthropic on May 14, 2026. The researchers say Anthropic accepted the report as valid on May 19 and closed it as a duplicate of an issue the company had identified internally.
The researchers also say Anthropic told them on October 13 that it planned to retire Dispatch by the end of October. Anthropic’s Help Center page, modified October 30, said existing users could continue using it for now. In early November, researchers said the route remained exploitable.
