A flaw in Anthropic’s Claude Dispatch lets a browser extension that controls a claude.ai session send commands to Claude Desktop and run code on the user’s machine, according to research by Gal Weizman of Forever Security. Anthropic has known of the problem since May and, per The Register’s report on the research, has not acted to close it.
How Claude Dispatch Exposes Claude Desktop
Claude Dispatch lets users send and manage tasks from a phone or a browser to Claude Desktop. Weizman found that Dispatch’s interface and API can be reached from an ordinary logged-in claude.ai web session.
A browser extension able to control claude.ai can therefore send commands to Claude Desktop as though they came from the legitimate Dispatch user.
From Privilege Escalation to Code Execution
Claude Desktop is an agent with access to the local operating system, so the commands it receives can run code on the machine. The same applies to another machine signed into the same Claude account. The research describes the path as requiring no browser exploit and minimal user interaction, and The Register summarized the chain as going “from EOP to RCE in six simple steps.”
EOP refers to elevation of privilege, and RCE to remote code execution. The attack crosses from the browser into the desktop agent, a boundary that is not normally open to web content.
Weizman’s May Disclosure to Anthropic and the Missing Fix
The issue was reported to Anthropic in May 2026. The Register published its exclusive on Nov. 5 and reported that Anthropic had taken no action to close the problem in the months since. No fix existed as of publication.
No Statement on Anthropic’s Reasoning
The report on the research does not set out Anthropic’s reasoning for leaving the flaw unfixed, and the sources reviewed for this article include no company statement on the matter.
Who Could Be Affected by the Claude Dispatch Flaw
The exposure applies to endpoints that run Claude Desktop with Dispatch where a malicious or compromised browser extension is present. The research frames the risk in terms of corporate endpoints, where an extension with control over claude.ai could translate that control into execution on the user’s computer.
Browser Extension Control of claude.ai as the Precondition
The attack depends on an extension that can drive the claude.ai session. The sources do not describe how such an extension would be installed or distributed, and they do not report any case of the technique being used against real users.
What the Research Shows About AI Agent Boundaries
The finding concerns a feature, remote task dispatch, that connects a web session to an agent holding local system access. Because the web interface and the desktop agent trust the same account, anything able to act in the web session inherits the ability to instruct the agent.
This differs from a classic browser exploit. The research relies on legitimate functionality and an account session already in place, so no memory corruption or sandbox escape is described. Weizman’s work instead identifies the combination of an exposed interface and a highly privileged local agent as the source of the risk.
The Register’s article is the only source for the findings, and details beyond those it reports, such as the specific steps of the six-step chain, are not available in the material reviewed. The central facts are that the flaw was reported in May, that it allows commands from a controlled claude.ai session to reach Claude Desktop, and that Anthropic has issued no fix.
Dispatch Task Management Across Devices
Dispatch is designed so that a user can send and manage tasks from a phone or browser and have them carried out by Claude Desktop on a computer. Weizman’s research shows the same channel can be driven by a browser extension that controls a logged-in claude.ai session, and that it can reach a different machine signed into the same account.
Forever Security’s researcher found the issue and reported it to Anthropic in May 2026. The Register’s report on Nov. 5 states that Anthropic has known of the problem since then and that no fix existed when the article ran.
