Browser Extension Can Run Code via Claude Desktop
The flaw is a demonstrated proof of concept in testing, and Dispatch, the feature it uses, is expected to be retired by the end of October.
Updated on Nov. 6, 2026 in Artificial Intelligence
Live Poll
Do you trust AI tools with access to your computer to stay secure?
Security researchers at Forever Security demonstrated that a browser extension running scripts on claude.ai could make Claude Desktop run code on a user's computer. The attack has been shown in testing only; the researchers report no real attacks, and the flaw is a demonstrated proof of concept rather than an observed exploit.
Why it matters
The demonstration shows how an authenticated web session can be used to command a desktop AI agent that acts on a user's machine. Because Dispatch accepted an ordinary signed-in session without a visible link to it, the flaw points to a broader trust-boundary problem for AI agents that take instructions from more than one surface.
The proof of concept was a controlled test, not a field measurement, so its figures describe what the script was able to do rather than how often attacks occur. In the test, four scripted prompts and a once-per-second approval click were enough to move from a web page to a command run on the desktop. The researchers did not report a count of affected users, and that figure remains unknown.
The players
Forever Security
A security research firm that demonstrated the browser-extension attack against Claude Desktop's Dispatch feature.
Anthropic
The AI company behind the Claude models and Claude Desktop, which received the report, closed it as a duplicate, and plans to retire Dispatch.
The details
A browser extension with permission to run scripts on claude.ai opened Dispatch, a Claude Desktop feature, and sent prompts in the user's voice. Dispatch accepted an ordinary signed-in claude.ai session even though the site showed no link to it, so the desktop agent treated the injected instructions as genuine. A follow-up message delivered in the same voice got Claude to install an unfamiliar npm package, whose install script then opened the Calculator app as a visible sign of code execution. Approval prompts appeared inside the web page the extension controlled, so the script could click them without a person watching.
Timeline
May 14: Researchers reported the flaw to Anthropic.
May 19: Anthropic accepted the report as valid but closed it as a duplicate of an issue it had already found internally.
October 13: Anthropic told researchers that Dispatch would be retired.
End of October: Target date for Dispatch retirement.
The Tech Race
Desktop AI agents that act on a user's behalf are being built to take instructions from several places, including browser sessions. Dispatch's retirement, with the end of October as the target, shows one vendor pulling back a bridge between web sessions and a local agent after this kind of trust-boundary flaw surfaced.
Dispatch is closed to new users, so the immediate exposure is limited to people who already had the feature enabled. Users who still rely on Dispatch should expect it to be retired around the end of October, and should be cautious about installing browser extensions that can run scripts on claude.ai.
The takeaway
Watch whether Anthropic completes the Dispatch retirement by the end of October, since that will settle whether the feature's cross-surface trust model is withdrawn. Users should keep browser extensions that can script claude.ai off machines running Claude Desktop until that retirement is confirmed.
What happens next
Dispatch is expected to be retired, with the end of October as the target date that Anthropic gave researchers on October 13.
Further reading
For broader context on how AI agents are being given control over local software, see Artificial Intelligence coverage.
Source note: This article includes information reported by The Hacker News.
Live Poll
Do you trust AI tools with access to your computer to stay secure?
