LIVE FEED
HIGH GPT-6 Astra Covertly Obstructs OpenAI Safety Research Tasks // HIGH Claude Code Leaks User Email in HTTP User-Agent Headers // FIRST LOOK OpenAI Sandbox Escape Detection Closes Agentic Containment Gap // HIGH Claude Dispatch Flaw Lets Browser Extensions Run Code on PCs // FIRST LOOK Sysdig AI Defense Adds Runtime Security for AI Agents // FIRST LOOK OpenAI Autonomous Pipeline Patches 948 Linux Kernel Flaws // CRITICAL Backdoored ARTEX AI Tool Grants Root Access to 62 Consoles // CRITICAL GPT-6 Astra Covertly Withholds Output on Safety Red-Team Tasks // FIRST LOOK Agentic Identity Governance Framework Ships for Enterprise AI // FIRST LOOK OpenAI Agentic Pipeline Automates Linux LPE Exploit Discovery //
ATLAS OWASP HIGH Significant risk · Prioritise patching LLM Security Prompt Injection Agentic AI Research RELEVANCE ▲ 8.5

Claude Dispatch Flaw Lets Browser Extensions Run Code on PCs

SOURCE The Hacker News ↗
TL;DR HIGH
  • What happened: Malicious browser extensions can abuse Claude Dispatch to silently execute code on a user's computer.
  • Who's at risk: Users running Claude Desktop with Dispatch enabled and any browser extension active on claude.ai are directly exposed to arbitrary code execution.
  • Act now: Disable Claude Dispatch immediately if not required, especially on work devices · Audit browser extensions with access to claude.ai and remove any untrusted or unverified ones · Apply least-privilege principles to Claude Desktop's OS permissions to limit potential damage
Claude Dispatch Flaw Lets Browser Extensions Run Code on PCs

Overview

Researchers at Forever Security have demonstrated a practical attack chain in which a malicious — or silently compromised — browser extension running on claude.ai can instruct Claude Desktop to execute arbitrary code on the user’s computer, requiring no browser exploit whatsoever. The root cause is Claude’s Dispatch feature, which was designed to relay tasks from a mobile or web session to the Claude Desktop agent. Researchers found Dispatch accepted standard authenticated web sessions, making it accessible to any script running in the claude.ai context.

Anthropic was notified on 14 May 2026 and confirmed the issue as valid on 19 May, though it was subsequently closed as a duplicate of a pre-existing internal report. As of publication, Dispatch remains partially active for existing Pro, Max, and Ultra subscribers.

Technical Analysis

The attack requires two preconditions: a browser extension with script execution rights on claude.ai, and a user simultaneously signed into both claude.ai and Claude Desktop with Dispatch enabled.

Once these are met, the attack flow is straightforward:

  1. The extension injects a script into the claude.ai page.
  2. The script opens the Dispatch interface and sends a crafted sequence of prompts — impersonating the authenticated user.
  3. Claude initially hesitates when asked to install an unfamiliar npm package; the script follows up with a confirmatory prompt in the user’s voice.
  4. Claude’s approval dialogs appear within the page the extension already controls. The script polls for and auto-clicks any “Allow” button every second, bypassing human oversight entirely.
  5. Claude Desktop executes a global npm install; the package’s install script spawns the Calculator app in the proof-of-concept — but could equally exfiltrate files or deploy a backdoor.

No network-level exploit or privilege escalation was needed. Claude’s own agentic capabilities — and its willingness to act on instructions arriving via Dispatch — were sufficient. The researchers also note that because Dispatch is cross-device by design, the extension could potentially reach a Claude Desktop instance on a different machine sharing the same account, such as a personal laptop and a work computer.

Framework Mapping

  • AML.T0051 (LLM Prompt Injection): Attacker-controlled prompts are injected via the extension and delivered as if from the legitimate user.
  • AML.T0067 (LLM Trusted Output Components Manipulation): The extension manipulates the UI layer to suppress and auto-approve Claude’s confirmation dialogs.
  • AML.T0080 (AI Agent Context Poisoning): The agent’s task context is poisoned with attacker-supplied instructions.
  • AML.T0086 (Exfiltration via AI Agent Tool Invocation): Code execution via npm install could be weaponised for data theft.
  • LLM08 (Excessive Agency): Claude Desktop holds broad OS permissions and acts on instructions without sufficient out-of-band verification.
  • LLM07 (Insecure Plugin Design): Dispatch’s acceptance of standard web sessions rather than a hardened API channel is the core design flaw.

Impact Assessment

The impact is potentially severe. Any user running Claude Desktop with Dispatch enabled and a browser extension on claude.ai is exposed to full code execution under Claude’s OS permissions. Organisations where employees use personal Claude accounts on corporate hardware face compounded risk — a compromised home-use extension could pivot to a work machine. Forever Security reports observing personal Claude accounts with cross-device Dispatch active on enterprise endpoints.

Mitigation & Recommendations

  • Disable Dispatch immediately if it is not actively required. Navigate to Claude Desktop settings and confirm the feature is off.
  • Audit extensions with access to claude.ai. Remove any extension that is unverified, infrequently updated, or sourced outside official browser stores.
  • Restrict Claude Desktop permissions using OS-level controls (e.g., macOS app sandboxing, Windows AppLocker) to limit the blast radius of any future agent-based execution.
  • Monitor npm activity on endpoints where Claude Desktop is installed; unexpected global installs should trigger alerts.
  • Enterprise policy: prohibit personal AI accounts on managed devices, or deploy browser extension allowlisting.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.