Forever Security researcher Gal Weizman found that Claude Dispatch’s interface and API were reachable from an ordinary logged-in claude.ai session, The Register reports. Any browser extension that can control claude.ai could send commands to Claude Desktop, which can run code on your computer, or another machine signed into the same account.
What Anthropic did
- Acknowledged it as valid in May, closed it as a duplicate of a known issue, with no bounty and no CVE
- Told him it planned to retire Dispatch at the end of October. As of Oct 30 the support page still listed it in limited beta for existing users
- Didn’t answer The Register’s questions
Weizman says the design weakness lives on in Claude Code Remote Control and Cowork sessions.
What to do
If you use Dispatch or Remote Control, audit your browser extensions and remove anything you don’t need. Better yet, use a separate browser profile with no extensions for claude.ai.
My take
Garlic because it’s not fixed. Any agent that can run commands needs a trust boundary that a browser extension can’t cross.
God Bless, and Needs Garlic!
