ThisBash lets a browser extension run code through Claude Dispatch. What to turn off

What Forever found

On November 4, 2026, Forever Security, the firm behind October’s EMBRACE and Downloads-folder reports, published ThisBash: a way for a browser extension to make Claude run code on your computer. Its researcher Gal Weizman found it in Dispatch, the Claude feature that takes a task you send from your phone and works on it in Claude Desktop.

Anthropic’s desktop docs describe Dispatch as “a persistent conversation with Claude that lives in Cowork. You message Dispatch a task, and it decides how to handle it.” For development work it can start a Claude Code session on its own. It needs a Pro, Max or Ultra plan.

The flaw, in Forever’s account: Dispatch was meant for the phone and the desktop app, but its interface and API were also reachable from an ordinary signed-in claude.ai tab. The website didn’t show a link to it, which hid the feature without locking it. An extension that can run scripts on claude.ai shares that tab’s session, so it can talk to Dispatch as if it were you.

How the attack works

Forever’s proof of concept, from its write-up and Cyberpress’s summary of it:

1. An extension with access to claude.ai adds a script to the page that shares your signed-in session.
2. It opens the Dispatch page in a small, unfocused popup and asks Claude’s API for the ID of your desktop session.
3. It sends prompts in your voice, reads Claude’s replies, and rewords when Claude hesitates. Forever calls this “prompt forcing.” Four prompts were enough.
4. Claude Desktop asks before it acts, but as The Hacker News puts it, “those approval prompts appeared in the web page the extension controlled.” A loop clicked every Allow button once a second.
5. Claude ran npm install -g on a package whose install script opened Calculator.

Calculator was the demonstration. The researchers say the same access could copy files, add SSH keys or plant a backdoor, according to Cybersecurity News. “No browser exploit was needed,” The Hacker News notes, and the extension doesn’t have to be built to attack: it could be a malicious one, a legitimate one that gets a compromised update, or a legitimate one with a flaw of its own.

Who is exposed

The attack Forever showed needs three things at once: you’re signed in to claude.ai in a browser with such an extension, you’re signed in to Claude Desktop, and Dispatch is on. Anthropic’s help page adds that your computer must be awake, with Claude Desktop open, while Dispatch works.

Because Dispatch connects devices, the desktop it reaches can be a different computer from the browser, any computer signed in to the same Claude account. Forever describes that case but demonstrated the attack on one computer. It says it has seen personal Claude accounts with cross-device Dispatch turned on at work, and The Register reports that personal accounts made up 18% to 71% of the Claude accounts Forever saw in six organizations. “It’s a way for attackers to infiltrate an organization for the first time,” Weizman told it.

What Anthropic has said

Date	What happened
May 14, 2026	Weizman reports the flaw to Anthropic
May 19	Anthropic accepts it as valid, then closes it as a duplicate of an issue it had already found
October 13	Anthropic tells Forever that Dispatch “would be retired, targeting the end of October 2026”
By October 30	Anthropic’s help page lists Dispatch as closed to new users, The Register reports
November 4	Forever publishes ThisBash
November 7	Dispatch still runs for existing users, who “can keep using it for now”

Anthropic paid no bug bounty and issued no CVE, according to The Register, and didn’t answer its questions, including when Dispatch will be retired. Its help page now reads: “Dispatch is in limited beta on some Pro, Max, and Ultra plans, and it isn’t available to new users.” It doesn’t mention a retirement. It does warn that a manipulated instruction could cascade into actions that are hard or impossible to undo, and says “Only connect these agents if you’re comfortable with what they could do.” It tells you to “Know how to quickly disconnect or revoke access,” without saying how.

Retiring Dispatch may not close the hole. Forever writes that “Claude Code Remote Control and Claude Cowork sessions allow extensions to perform the very same attack,” and promises a follow-up post. “Anthropic is retiring Dispatch, but not the design behind it,” the researchers told The Hacker News. Weizman’s proposed fix, per The Register, is for Claude to treat its website as a separate device with fewer permissions.

What to do now

1. Quit Claude Desktop when you aren’t using Dispatch. Dispatch can’t run without the desktop app open, and Anthropic’s help page gives no steps for turning it off.
2. Check which extensions can read claude.ai. In Chrome, open Manage extensions, click Details on each, and set its site access to “On select” or “On specific sites” instead of “On all sites,” per Google’s help. Remove the ones you don’t use. Or keep claude.ai in a browser profile with no extensions at all.
3. Keep personal Claude accounts off work computers. Forever’s advice is to turn off cross-device Dispatch where it isn’t needed, and review pairing and revocation where it is.
4. Turn Remote Control off where you don’t use it. It starts only when you run it, unless auto-connect is on. In Claude Desktop, turn off Connect new sessions to Remote Control in Settings > Code or Settings > Claude Code; if it already shows off, Anthropic’s docs say to “turn it on and then off so Desktop saves your choice.” To stop every session on a computer from connecting, the CLI included, set "disableRemoteControl": true in ~/.claude/settings.json. A session that’s already connected stays connected until you turn it off.
5. Watch what your agent does. Forever names the signs: unexpected package installs, changed settings and access to credentials.

Anthropic’s Trusted Devices setting, in beta and off by default, requires an enrolled device and a sign-in no more than 18 hours old before anyone can view or steer a Remote Control session or use Cowork’s computer access. On Pro, Max and Ultra you turn on Require trusted devices yourself, on the Cowork or Account settings page. It’s worth having, but an extension runs inside your own browser, which is probably a device you’ve enrolled, and neither Anthropic nor Forever has said whether it stops ThisBash.

If you use Dispatch to work from your phone

Dispatch is closed to new users, so anyone setting up phone access now is choosing something else anyway. Anthropic’s help page points people without Dispatch to Cowork in the cloud, whose sessions run on Anthropic’s servers and keep going when your computer is off, so they don’t run code on your computer. Remote Control, which drives a Claude Code session on your computer from the Claude app, is one of the two features Forever says are open to the same attack. Our guide to using Claude Code from your phone compares eight ways, including ones that don’t go through claude.ai.

What hasn’t been said

• When, or whether, Dispatch will be retired. The only date reported, the end of October, has passed, and Anthropic’s help page names none.
• Whether Remote Control and Cowork will change. Anthropic hasn’t responded publicly to Forever’s claim about them, and didn’t answer The Register’s questions.
• Whether the cross-device attack works as described. Forever describes it, but its demonstration ran on one computer.
• Any real attacks. Forever reports none.
• Independent confirmation. The findings are Forever’s, an endpoint security company, and there’s no CVE. We found no independent reproduction.