Claude Dispatch Flaw Lets Malicious Extensions Run Code Locally
Researchers found that browser extensions exploiting Claude AI's Dispatch feature could execute arbitrary code on users' machines. This highlights new risks in AI-assisted desktop workflows.
TL;DR
- A vulnerability in Claude’s Dispatch feature allows malicious browser extensions to run code locally.
- Exploitation requires a compromised extension with access to claude.ai and the user’s consent to Dispatch.
- Endpoint security firm Forever Security demonstrated the attack vector in a controlled test.
- The issue remains unpatched, posing a risk to users of Claude Desktop with active browser integrations.
- Organizations using AI tools should audit browser extension permissions and monitor local AI agent interactions.
Security researchers at Forever Security have uncovered a novel attack vector involving browser extensions and Anthropic's Claude AI platform. By leveraging the Dispatch feature—which allows users to send tasks from mobile devices to Claude Desktop—attackers could potentially execute arbitrary code on a victim's machine.
The core of the vulnerability lies in how browser extensions with access to claude.ai can interact with the Dispatch mechanism. Although the attack requires some user interaction and specific conditions, it demonstrates an emerging class of threats targeting AI-integrated desktop environments.
Attack Requirements and Execution
- The attack requires a malicious browser extension installed and granted permission to interact with claude.ai.
- Victims must also have Claude Desktop installed and actively use the Dispatch feature.
- Once triggered, the extension can instruct Claude Desktop to perform actions that lead to local code execution.
- No remote exploitation is needed—the malicious logic runs directly on the user's device via the AI client.
Security Implications for Enterprises
- This attack model blends social engineering with supply chain risks through third-party browser extensions.
- Organizations integrating AI assistants into employee workflows should review extension policies and permissions.
- Monitoring for unusual activity in AI desktop clients could help detect such abuse post-exploitation.
- Vendors like Anthropic are encouraged to implement stricter sandboxing and origin checks for Dispatch-initiated tasks.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.