Claude Dispatch Flaw Lets Browser Extensions Trigger Desktop Code Execution

The attack chain requires only a signed-in Claude session and a browser extension capable of script injection on claude.ai. Dispatch accepted web-origin instructions as legitimate user tasks, allowing prompts that first requested package installation and then confirmed execution. The desktop agent performed the actions while the extension auto-approved every dialog appearing on the controlled page.

Report timelines show the issue was disclosed to Anthropic on 14 May, accepted as valid on 19 May, then closed as a duplicate of an internal finding. The company stated Dispatch would be retired by end of October, yet the help page still lists it as available to existing Pro, Max, and Ultra subscribers without mentioning the shutdown. Two additional features, Claude Code Remote Control and Claude Cowork sessions, retain the same cross-origin trust model.

The design pattern of allowing web sessions to drive a locally privileged agent creates persistent exposure across personal and work devices sharing one account. Procurement and incident records from other AI agent platforms show similar cross-device command channels repeatedly surface as high-impact vectors once extensions or compromised updates enter the browser.

Users should immediately disable cross-device Dispatch and audit paired devices. Anthropic has not published a timeline for equivalent controls on the remaining features, leaving the underlying authorization gap open.