Researchers Show Browser Extensions Can Run Code Through Claude Dispatch

Researchers at Forever Security demonstrated that a browser extension could abuse Claude Dispatch to run code on a user’s computer. The test showed that Dispatch, which lets a user send tasks from claude[.]ai to Claude Desktop, could be triggered by an ordinary signed-in session on claude[.]ai—even though the Claude website did not present a link to Dispatch—allowing an extension on the web page to issue Dispatch instructions as if issued by the user.

The proof-of-concept relied on a script on claude[.]ai that prompted Claude to install an npm package, with subsequent prompts appearing in the user’s own voice and automatically clicking “Allow” so no one needed to watch.

The attack requires two elements: a suitable extension capable of running scripts on claude[.]ai, and a user signed in to both claude[.]ai and Claude Desktop with Dispatch enabled. In the test, Claude executed a global npm install and the package’s install script opened the Calculator app; the researchers note that, given Claude’s permissions, this could have exfiltrated files or installed a backdoor.

The researchers contacted Anthropic on 14 May; Anthropic accepted the report as valid on 19 May but treated it as a duplicate of an internal issue. The researchers warn that Dispatch is being retired, though the help page had not been updated to reflect a final retirement date, and that the same design could be exploited via Claude Code Remote Control and Claude Cowork sessions.

To mitigate, they advise turning off cross-device Dispatch if not needed, reviewing device pairings, and scrutinising extension permissions and updates, as well as monitoring AI agent activity on the computer.