Anthropic won't fix Claude Dispatch flaw that enables remote code execution

Anthropic has decided not to fix a vulnerability in Claude Dispatch that lets any browser extension controlling claude.ai execute commands through Claude Desktop, security researcher Gal Weizman told The Register. Anthropic has not issued a CVE for the flaw, and no fixed version has been released; Anthropic marked Weizman's report valid in May but closed it as a duplicate and paid no bug bounty, according to The Register.

Claude Dispatch lets users send tasks from a phone or browser to Claude Desktop, which runs commands on the computer. Weizman found that both the Dispatch interface and its API were accessible from a normal logged-in web session at claude.ai, meaning an extension could issue commands as if they came from the legitimate user. By mid-2026, claude.ai was drawing roughly 950 million monthly visits, and Cowork appeared in 1.2 million sessions sampled from more than 600,000 organizations in May, The Register reported, citing Anthropic usage data.

In his proof of concept, Weizman had the extension register a script on claude.ai, open Dispatch in a small popup, retrieve the Claude Desktop agent's ID, send a series of prompts, auto-click approval dialogs about once per second, and continue until code ran. The demonstration had Claude run npm install -g on a malicious package. The Register observed that a real-world attack could do more than open a harmless calculator, such as running malware that exfiltrates source code or cloud credentials, or installs a backdoor.

Because Dispatch works across machines, a compromised browser session can also control Claude Desktop on a different computer signed into the same Claude account. Weizman said that if an employee shares a personal account across a home laptop and a work laptop, Dispatch becomes a bridge into the organization. Forever Security, where Weizman works, found personal Claude accounts in corporate environments at rates from 18 percent to 71 percent in six customer organizations; one company had 255 personal accounts among 1,233 known Claude accounts, The Register reported.

Anthropic's support page said on October 30 that Dispatch was available in beta to selected Pro, Max, and Ultra customers, but was not offered to new users. The page also said current users could keep using it for now, and Anthropic did not respond to The Register's questions, including when it planned to retire Dispatch. Tech Insider, citing product source material it reviewed, reported that Dispatch was absent from Team and Enterprise plans, and that Remote Control was disabled by default on those workspaces; it said the refusal-to-fix claim remained unconfirmed.

Weizman said his research "started with a vulnerability. And it ended up being a design choice that enables this attack vector very easily," and that a similar risk now exists in Claude Code's Remote Control feature and Cowork sessions. He told The Register that Cowork is reachable through the web version and shares sessions with the desktop app, so an extension can use Cowork sessions to access files, install malicious npm packages, or run code on the host operating system. He recommends treating the web version as a separate device with lower security permissions and blocking potentially harmful actions.