Anthropic Refuses to Patch Claude Dispatch Flaw Enabling Remote Command Execution
A critical vulnerability in Anthropic's Claude Dispatch feature, dubbed ThisBash, allows malicious browser extensions to execute arbitrary commands on a user's system, but the company has opted not to fix it.
A significant security flaw in Anthropic's Claude Dispatch feature, discovered by researcher Gal Weizman and named ThisBash, allows for the execution of remote commands on a user's computer or other devices logged into the same Claude account. The vulnerability requires no browser exploit and minimal user interaction, posing a substantial risk to users and organizations.
Weizman found that the Claude Dispatch API, designed to allow users to send and manage tasks from mobile devices or browsers to the Claude Desktop AI agent, is accessible directly from the claude.ai website. This means any browser extension with access to claude.ai could potentially send commands to Claude Desktop, effectively impersonating the legitimate user. "That extension was able to perform a classic escalation of privileges. Because now Claude has access to the files in the operating system, it can run code on the operating system and compromise the machine completely," Weizman stated.
Anthropic was notified of the vulnerability in May. Despite acknowledging it as valid, the company closed the security issue without a fix, citing plans to retire the Dispatch feature. However, as of late October, the feature remained available in a limited beta, with Anthropic failing to provide a timeline for its removal. This decision leaves millions of users exposed to potential compromise.
Even if Dispatch is eventually retired, Weizman warns that the underlying design weakness persists in other Claude features, including Claude Code Remote Control and Claude Cowork sessions. These features also allow web-based access to desktop functionalities, creating similar attack vectors. "Once again, using an extension, you can use the Cowork sessions to say: ‘Please access this file and grab it. Please install this malicious npm package. Please run code on the operating system.’ And it would," Weizman explained.
The attack chain begins with a malicious browser extension, which could be a newly developed one or a compromised legitimate extension. This extension gains access to the user's Claude session cookies via the claude.ai website. It then opens the Dispatch interface in a small, unobtrusive popup and uses the user's session to query for active sessions, specifically targeting the Claude Desktop agent.
Once the agent's session ID is obtained, the extension initiates a "force prompting" sequence. It sends commands to the agent, instructing it to perform actions like installing npm packages or running arbitrary code. The attacker can rephrase prompts, insist on execution, and provide context to overcome any security prompts from Claude, ensuring the commands are eventually executed.
To bypass potential user approval prompts, the exploit uses a rapid, one-second interval click to "Allow" any on-screen requests from Claude. This automated approval mechanism ensures the attack continues uninterrupted, even if the user is not actively monitoring their screen, until a remote code execution (RCE) is achieved. Weizman's research highlights a concerning trend where AI product design choices can inadvertently create significant security vulnerabilities.
This incident underscores the growing security challenges associated with AI agents and their integration into user workflows. The decision by Anthropic not to patch a known critical vulnerability, despite its potential for widespread impact, raises serious questions about the company's commitment to user security and the responsible disclosure of security flaws in AI products.