A browser extension can make Claude Desktop run commands on a connected computer.

Verified: we read the researchers' own write-up at forever.security, including the mechanism, the proof of concept and the 3 dated disclosure steps. It surfaced late. The disclosure is dated November 4 and Edition 074 covered that window without reaching it, so we card it under its own event date. Anthropic has published nothing, so every statement attributed to it is the researchers' account.

Forever Security, an endpoint security company, published ThisBash Escape on Wednesday November 4, 2026, by researcher Gal Weizman. We read it at forever.security. The mechanism: Claude Dispatch, a Claude Desktop feature for sending tasks from a phone to the desktop, accepted an ordinary signed-in claude.ai session, though the website showed no link to it. A browser extension able to run scripts on claude.ai could therefore send instructions to Claude Desktop as though the user had, and the approval prompts appeared inside the page the extension controlled. The proof of concept used 4 prompts and a script clicking any Allow button once a second, from a background popup of 200 by 200 pixels. Claude installed an npm package globally whose install hook opened the Calculator. No browser exploit was needed. Preconditions: the user signed in to claude.ai and to Claude Desktop with Dispatch enabled, and the computer awake with the application open. The researchers describe, but say they did not demonstrate, reaching a Claude Desktop on a different computer on the same account. They report no real-world attacks. The timeline, as they give it: reported to Anthropic on May 14, 2026; on May 19 Anthropic accepted the findings as valid but closed the report as a duplicate of an issue it had already found internally, shown as a screenshot; on October 13 Anthropic said Dispatch would be retired, targeting the end of October 2026. The researchers write that "Anthropic is retiring Dispatch, but not the design behind it", and say the flaw can still be exploited, with Dispatch closed to new users while some Pro, Max and Ultra users retain it. They name Claude Code Remote Control and Claude Cowork sessions as sharing the trust pattern, say they tested neither, and promise a follow-up. Scale figures cited: roughly 950 million to 969 million monthly visits to claude.ai in September 2026, per Similarweb; a LayerX report finding 99% of enterprise users observed had an extension and 53% had extensions with high or critical permissions. No CVE or severity score is given. Not established: whether a fix exists, whether Dispatch has been retired, and whether the other 2 features are exploitable.

1. May 14

   Forever Security reports the flaw to Anthropic, with a working proof of concept in which Claude Desktop installs an npm package that opens the Calculator.

2. May 19

   Anthropic accepts the findings as valid but closes the report as a duplicate of an issue it says it had already found internally, according to the researchers' screenshot.

3. Oct 13

   Anthropic tells the researchers that Dispatch will be retired, targeting the end of October 2026. The researchers say the design behind it is not being retired.

4. Nov 4

   Forever Security publishes ThisBash Escape, naming Claude Code Remote Control and Claude Cowork sessions as sharing the same trust pattern, both untested.

5. Nov 6

   The disclosure reaches the security press, including The Hacker News, 2 days after publication. Anthropic has issued no statement.