{"schema":"sanctity-signal/0.2","record_type":"signal","id":"claude-dispatch-extension-rce-e077","domain":"security","drop_id":"signal-e077","occurred_at":"2026-11-04","how_to_use":"This is a structured record of one real-world action and its competing interpretations, from Sanctity Signal. To build content from it (a reel script, a blog, a thread): open on the hook, ground the viewer with plain and observed, walk the dated trail, present the interpretations as live tension between named readings, and close on the before/after shift and what_to_watch. Hard rules: items under established are fact; items under unknown are never presented as fact; the evidence status (verified or reported) is stated, not dropped; sources are cited.","actor":"Forever Security and Anthropic","action_type":"publication of a proof of concept in which a browser extension drives Claude Desktop into running system commands, and of Anthropic's choice to retire the feature rather than redesign it","observed":"Forever Security, an endpoint security company, published ThisBash Escape on Wednesday November 4, 2026, by researcher Gal Weizman. We read it at forever.security. The mechanism: Claude Dispatch, a Claude Desktop feature for sending tasks from a phone to the desktop, accepted an ordinary signed-in claude.ai session, though the website showed no link to it. A browser extension able to run scripts on claude.ai could therefore send instructions to Claude Desktop as though the user had, and the approval prompts appeared inside the page the extension controlled. The proof of concept used 4 prompts and a script clicking any Allow button once a second, from a background popup of 200 by 200 pixels. Claude installed an npm package globally whose install hook opened the Calculator. No browser exploit was needed. Preconditions: the user signed in to claude.ai and to Claude Desktop with Dispatch enabled, and the computer awake with the application open. The researchers describe, but say they did not demonstrate, reaching a Claude Desktop on a different computer on the same account. They report no real-world attacks. The timeline, as they give it: reported to Anthropic on May 14, 2026; on May 19 Anthropic accepted the findings as valid but closed the report as a duplicate of an issue it had already found internally, shown as a screenshot; on October 13 Anthropic said Dispatch would be retired, targeting the end of October 2026. The researchers write that \"Anthropic is retiring Dispatch, but not the design behind it\", and say the flaw can still be exploited, with Dispatch closed to new users while some Pro, Max and Ultra users retain it. They name Claude Code Remote Control and Claude Cowork sessions as sharing the trust pattern, say they tested neither, and promise a follow-up. Scale figures cited: roughly 950 million to 969 million monthly visits to claude.ai in September 2026, per Similarweb; a LayerX report finding 99% of enterprise users observed had an extension and 53% had extensions with high or critical permissions. No CVE or severity score is given. Not established: whether a fix exists, whether Dispatch has been retired, and whether the other 2 features are exploitable.","corrections":[],"evidence":{"status":"verified","note":"Verified: we read the researchers' own write-up at forever.security, including the mechanism, the proof of concept and the 3 dated disclosure steps. It surfaced late. The disclosure is dated November 4 and Edition 074 covered that window without reaching it, so we card it under its own event date. Anthropic has published nothing, so every statement attributed to it is the researchers' account.","sources":[{"role":"primary","label":"Forever Security: ThisBash Escape, Claude Dispatch flaw enables browser extension code execution, by Gal Weizman, Nov 4, 2026","url":"https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce"},{"role":"corrob","label":"The Hacker News: malicious browser extensions could use Claude Dispatch to run code on users' computers, Nov 6, 2026","url":"https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html"},{"role":"corrob","label":"Cybersecurity News: Claude Dispatch flaw lets browser extensions run code on connected computers","url":"https://cybersecuritynews.com/claude-dispatch-vulnerability/"},{"role":"corrob","label":"Dataconomy: Anthropic leaves Claude flaw enabling cross-device code execution unfixed, Nov 6, 2026","url":"https://dataconomy.com/2026/11/06/anthropic-leaves-claude-flaw-enabling-cross-device-code/"}]},"strength":{"cost":"Low","commitment":"Medium","reversibility":"Moderate","persistence":"Months","rationale":"Cost is low on both sides: the research cost a small team weeks, and retirement costs Anthropic less than redesigning how its desktop agents trust a browser session. Commitment is medium: a dated public disclosure with a working proof of concept cannot be unpublished, and the retirement decision was put in writing to the reporters, but no patch, advisory or CVE has been issued. Reversibility is moderate, because a feature can be retired and the pattern quietly kept, the researchers' whole complaint. Persistence is months: Dispatch goes away, yet the same trust model reportedly sits in Claude Code Remote Control and Cowork sessions."},"shift":{"prior":"An AI desktop agent is reachable only by the person sitting at it.","action":"Forever Security, an endpoint security company, published ThisBash Escape on Wednesday November 4, 2026, by researcher Gal Weizman. We read it at forever.security. The mechanism: Claude Dispatch, a Claude Desktop feature for sending tasks from a phone to the desktop, accepted an ordinary signed-in claude.ai session, though the website showed no link to it. A browser extension able to run scripts on claude.ai could therefore send instructions to Claude Desktop as though the user had, and the approval prompts appeared inside the page the extension controlled. The proof of concept used 4 prompts and a script clicking any Allow button once a second, from a background popup of 200 by 200 pixels. Claude installed an npm package globally whose install hook opened the Calculator. No browser exploit was needed. Preconditions: the user signed in to claude.ai and to Claude Desktop with Dispatch enabled, and the computer awake with the application open. The researchers describe, but say they did not demonstrate, reaching a Claude Desktop on a different computer on the same account. They report no real-world attacks. The timeline, as they give it: reported to Anthropic on May 14, 2026; on May 19 Anthropic accepted the findings as valid but closed the report as a duplicate of an issue it had already found internally, shown as a screenshot; on October 13 Anthropic said Dispatch would be retired, targeting the end of October 2026. The researchers write that \"Anthropic is retiring Dispatch, but not the design behind it\", and say the flaw can still be exploited, with Dispatch closed to new users while some Pro, Max and Ultra users retain it. They name Claude Code Remote Control and Claude Cowork sessions as sharing the trust pattern, say they tested neither, and promise a follow-up. Scale figures cited: roughly 950 million to 969 million monthly visits to claude.ai in September 2026, per Similarweb; a LayerX report finding 99% of enterprise users observed had an extension and 53% had extensions with high or critical permissions. No CVE or severity score is given. Not established: whether a fix exists, whether Dispatch has been retired, and whether the other 2 features are exploitable.","update":"A web page's extension can reach it, across machines, on one account."},"inference":{"established":["Forever Security reported the flaw to Anthropic on May 14, 2026.","Anthropic accepted it as valid and closed it as a duplicate.","On October 13 Anthropic said Dispatch would be retired, not fixed."],"unknown":["That anyone was attacked. The researchers report no real-world cases.","That cross-machine execution was demonstrated. They describe it, untested.","That Claude Code Remote Control is exploitable. It was not tested."]},"narrative":{"hook":"A browser extension can make Claude Desktop run commands on a connected computer.","plain":"On November 4 Forever Security published the flaw, which it reported to Anthropic on May 14. Anthropic accepted it, closed the report as a duplicate, and is retiring the feature rather than changing the design.","story":["Claude Dispatch trusted an ordinary signed-in web session. An extension on that page could send tasks to the desktop application and click its own approval prompts. The researchers say Claude Code Remote Control and Cowork sessions share the pattern, so retiring one feature does not retire the trust model behind it."],"trail":[{"d":"MAY 14","t":"Forever Security reports the flaw to Anthropic, with a working proof of concept in which Claude Desktop installs an npm package that opens the Calculator."},{"d":"MAY 19","t":"Anthropic accepts the findings as valid but closes the report as a duplicate of an issue it says it had already found internally, according to the researchers' screenshot."},{"d":"OCT 13","t":"Anthropic tells the researchers that Dispatch will be retired, targeting the end of October 2026. The researchers say the design behind it is not being retired."},{"d":"NOV 4","t":"Forever Security publishes ThisBash Escape, naming Claude Code Remote Control and Claude Cowork sessions as sharing the same trust pattern, both untested."},{"d":"NOV 6","t":"The disclosure reaches the security press, including The Hacker News, 2 days after publication. Anthropic has issued no statement."},{"d":"Reacts","r":true,"t":"Anthropic, which has not published on this; enterprise security teams whose staff run browser extensions, 53% of them with high or critical permissions on one count; the extension stores that approve those add-ons; everyone shipping a desktop agent that trusts a web session; and the bug bounty programmes that treat duplicate as closed."}],"glossary":[{"term":"Remote code execution","def":"Getting a program to run commands of an attacker's choosing on a machine. It is the most serious class of flaw, because it ends in control."},{"term":"Browser extension","def":"An add-on that can read and change the pages you visit. Its permissions, not the website's, decide what it can do on claude.ai."},{"term":"Closed as duplicate","def":"A vendor saying it already knew. The reporter gets no bounty and no fix date, and the disclosure clock keeps running."}]},"judgment":{"prompt":"Which explanation do you believe?","interpretations":[{"id":"a","label":"Agent products outran their security","text":"A shipped feature trusted a web session for 6 months after a valid report.","abstain":false},{"id":"b","label":"One narrow bug, now closing","text":"Dispatch was a niche feature, shut to new users, and is being retired anyway.","abstain":false},{"id":"c","label":"Retirement chosen over redesign","text":"Killing the feature is cheaper than rebuilding how desktop agents trust sessions.","abstain":false},{"id":"d","label":"Ordinary disclosure friction","text":"A duplicate report, an internal queue, a sunset. This is normal vendor process.","abstain":false},{"id":"e","label":"Too early to call.","text":"The evidence cannot yet separate these.","abstain":true}],"distribution":{"status":"held back until you have made your call","calls":null}},"story_thread":null,"what_to_watch":[{"linked_interpretation":"c","direction":"strengthens","observable_event":"Forever Security or another researcher publishes a working proof of concept against Claude Code Remote Control or Cowork sessions using the same trust pattern, by May 4, 2027.","window_end":"2027-05-04","state":"unresolved"},{"linked_interpretation":"c","direction":"weakens","observable_event":"Anthropic publishes a security advisory or changelog describing a change to how desktop features authenticate a browser session, rather than only retiring Dispatch, by March 31, 2027.","window_end":"2027-03-31","state":"unresolved"},{"linked_interpretation":"a","direction":"strengthens","observable_event":"Any vendor shipping a desktop AI agent discloses a comparable browser-to-desktop execution flaw, or a real-world attack using one is reported, by December 31, 2027.","window_end":"2027-12-31","state":"unresolved"}]}