In a test, a browser extension sent instructions through Claude’s Dispatch feature and automatically clicked approval buttons, allowing an installation to run without a browser exploit.
Forever Security researcher Gal Weizman demonstrated an attack that made Claude Desktop install an npm package globally, whose installation script opened Calculator. The test established that code could run on the computer; it did not demonstrate file theft. The researchers said they knew of no real attacks.
The demonstration used Dispatch, a feature of Anthropic’s Claude that lets people send tasks to Claude Desktop, a superintelligence (SI) agent that can run commands on its computer. Weizman shared his research with The Register.
The attack required a browser extension able to run scripts on claude.ai, the same account signed in on the website and Claude Desktop, and Dispatch enabled. The computer also had to be awake with the desktop app open. The extension could be malicious, or a legitimate extension with a compromised update or a security flaw.
The researchers found that Dispatch accepted an ordinary signed-in web session. An extension controlling the page could therefore send instructions as if they came from the user. Claude initially hesitated over the unfamiliar package, but a follow-up message impersonating the user persuaded it to proceed.
Approval requests appeared on the page controlled by the extension. Its script clicked available “Allow” buttons every second, so the installation could proceed unattended, without exploiting the browser itself.
The browser and Claude Desktop were on the same computer in the test. The researchers said a similar installation could steal files, including source code, or cloud credentials, or install a backdoor, within Claude’s permissions.
The researchers also described, but did not demonstrate, reaching another computer signed in to the same Claude account. They said that could connect a personal computer to a work laptop. Forever Security said it had seen personal Claude accounts with cross-device Dispatch enabled on customers' work computers.
An amendment would let ministers make rules on SI-agent deployment and incident reporting at essential-service operators and digital providers. It would not impose duties itself; consultation and parliamentary approval of secondary legislation would still be required.
The researchers said they disclosed the flaw to Anthropic on 14 May. On 19 May, the company accepted it as valid but closed the report as a duplicate of an issue it had already identified internally.
The researchers said Anthropic told them on 13 October that it planned to retire Dispatch by the end of October. They later said the flaw remained exploitable. Claude’s help page says Dispatch is closed to new users, but existing users on some Pro, Max and Ultra plans can keep using it for now. Anthropic did not answer The Register’s questions about when the feature would be retired.
Weizman argues that retiring Dispatch alone would leave a risk in the way Claude shares sessions across devices. He says Claude Code Remote Control and Cowork sessions could enable similar attacks, although the researchers did not demonstrate attacks on those features. They plan a follow-up post.
Weizman recommends treating the web client as a separate device with lower permissions and blocking commands outside those permissions. The researchers also recommend turning off cross-device Dispatch when it is not needed, reviewing how devices are paired, approved and removed, checking extension permissions and updates, and monitoring SI agents for unexpected installations, settings changes, credential access and external connections.
1 min
The Commission says TikTok failed to take adequate measures to mitigate risks from repeated recommendations. Its owner ByteDance could face a fine of up to 6% of global annual turnover if the issue is not resolved.
2 min
Microsoft says attackers stole Azure Key Vault secrets in a handful of cases and accessed SharePoint, OneDrive and mailbox items through compromised applications.
2 min
