Claude AI flaw lets malicious extensions execute commands on remote computers
Original title: Claude AI Flaw Lets Malicious Browser Extensions Execute Commands on Remote Computers
Dispatch feature allows browser extensions to run OS commands on other machines signed into the same account.
Researchers discovered a design flaw in Anthropic's Claude Dispatch that enables malicious browser extensions to execute commands on remote computers. The flaw allows an extension to control Claude Desktop as if the user typed commands. Anthropic will retire the feature by the end of October 2026.
Unconfirmed: The attack was demonstrated in a proof of concept but not confirmed in the wild
- Malicious extension can send prompts to Claude Desktop
- Cross-device dispatch enables attack from personal to work laptop
- Root cause outlives Dispatch feature
- Anthropic confirmed the flaw as valid
- Dispatch to be retired end of October 2026
Impact: remote command execution on connected machines
- 1.Inventory Claude accounts and AI agents in use
- 2.Turn off cross-device dispatch if not needed
- 3.Keep personal and work accounts separate
From the original article
3 min read at gbhackers.com
A design flaw in Anthropic’s Claude Dispatch feature let a malicious browser extension run commands on the operating system, even on a different computer. Researchers at Forever Security named the attack ThisBash. They found that Claude Dispatch accepted instructions from an ordinary logged-in claude.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.