Forever Security researcher Gal Weizman says a browser extension able to control an authenticated claude.ai session used Claude Dispatch to direct Claude Desktop to install a package that opened Calculator. The controlled proof of concept demonstrated local code execution; it was a researcher-reported test, not evidence of attacks in the wild. Weizman’s technical report calls the issue ThisBash.
When an AI agent can act on a desktop, treat browser access, agent permissions, and approval controls as parts of the same security boundary.
What the proof of concept showed
In the reported test, Claude initially hesitated to install an unfamiliar package. Weizman says follow-up prompts led Claude to proceed, and the installed package opened Calculator. The point was that an extension controlling the logged-in web session could use Dispatch to influence a more privileged desktop agent. The demonstration did not require a browser exploit.
That result describes the scope of Weizman’s proof of concept. It does not establish that someone used the route to compromise victims in the wild.
The account and device conditions
The described route depended on an extension with enough access to control claude.ai while a user was signed in. For execution on a different computer, the same account also had to be connected to a reachable desktop through Dispatch.
That makes a cross-device workplace scenario conditional: an extension acting through a personal browser could reach a work computer only if the account’s Dispatch connection gave it access to that desktop. Weizman describes this as a possible bridge between personal browsing and a corporate endpoint, not as a confirmed compromise.
What Anthropic’s October documentation said
Forever Security says it disclosed ThisBash to Anthropic on May 14, 2026. The researcher says Anthropic acknowledged the finding as valid on May 19 and closed the report as a duplicate of an issue it already knew about. He also says Anthropic told him on October 13 that it planned to retire Dispatch, targeting the end of October.
Anthropic’s Help Center article, updated October 30, 2026, said Dispatch was in limited beta for some Pro, Max, and Ultra plan users, was unavailable to new users, and could still be used by existing users “for now.” The article says Dispatch requires the latest Claude Desktop and mobile apps, an internet connection on both devices, and a desktop computer that is awake with Claude Desktop open while a task runs. Anthropic’s Dispatch guidance also says computer-use tasks are unavailable in the Linux beta, though file, connector, and plugin tasks remain usable there.
Safeguards the researcher recommends
Forever Security’s proposed organizational measures focus on controlling the authority and routes available to agents. The company recommends inventorying agent identities and permissions, limiting remote-control features that an organization does not need, and governing browser-extension installation and permissions. It also recommends keeping approval controls separate from interfaces an attacker could control and monitoring agent actions, including unexpected software installations and changes to files or configurations.
