Claude Dispatch: Code Execution via Browser Extensions

At-A-Glance Incident Diagnostic Telemetry

Diagnostic Metric	Operational Telemetry & Defense Status
Advisory Authority	CyberNewsAI Threat Intelligence & Incident Response Directorate
Threat Severity Rating	MEDIUM (CVSS v3.1: 5.5 / Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Exploitation Activity	🟢 NO KNOWN IN-THE-WILD EXPLOITATION DETECTED
Remediation State	OFFICIAL VENDOR PATCH AVAILABLE (Deploy Immediately)
CISA KEV Catalog	MONITORED FOR CISA KEV CATALOG INGESTION
Targeted Perimeter	Mobile Fleets, Handsets & Carrier Telemetry Infrastructure
Continuous Monitoring	ACTIVELY MONITORED // Telemetry Verified: 2026-11-06

---

Executive Incident Briefing (2-Minute CISO Brief)

1. Strategic Incident Overview

Researchers at Forever Security have identified a technical vulnerability in the Claude Dispatch feature, which allows a browser extension to execute code on a user's computer via the Claude Desktop application. The attack requires a malicious or compromised browser extension and a user signed in to both claude.ai and Claude Desktop with Dispatch enabled. The vulnerability can be exploited to install malicious packages, steal files, or install backdoors, given Claude's permissions on the computer.

The researchers reported the flaw to Anthropic, the company behind Claude, on May 14, and it was accepted as valid on May 19. However, the report was closed as a duplicate of an issue already found internally. Anthropic has announced plans to retire the Dispatch feature by the end of October.

The vulnerability highlights the risks of cross-device features and the importance of proper security measures, such as quickly disconnecting or revoking access to features like Dispatch.

2. Business Impact & Perimeter Exposure

The vulnerability can have significant operational and financial impacts on organizations that use Claude Desktop and have Dispatch enabled. The vulnerability can be exploited to install malicious packages, steal files, or install backdoors, which can lead to data breaches, intellectual property theft, and other malicious activities.

3. Compliance & Governance Blast Radius

The vulnerability may trigger applicable regulatory requirements, such as GDPR Art. 33, NIS2, and SEC 8-K, depending on the affected sector and geography. Organizations that use Claude Desktop and have Dispatch enabled should review their security measures and ensure that they are compliant with relevant regulations.

---

Technical Vulnerability Analysis & Attack Chain

Root-Cause & Exploitation Mechanics

The vulnerability is made possible by the Dispatch feature, which allows users to send tasks from their phone to Claude Desktop. The feature requires a browser extension that can run scripts on claude.ai and a user signed in to both claude.ai and Claude Desktop with Dispatch enabled. The extension can be malicious, a legitimate one that received a compromised update, or a legitimate one with a security flaw.

In the test conducted by the researchers, a script on the user's claude.ai page opened Dispatch and sent Claude four prompts as if it were the user. The prompts asked Claude to install an npm package, which was initially hesitated over but eventually installed after a follow-up message. The script clicked any "Allow" button every second, allowing the installation to proceed without user intervention.

The vulnerability can be exploited to install malicious packages, steal files, or install backdoors, given Claude's permissions on the computer. The researchers note that no browser exploit was needed, and the same step could have been used to steal files or install a backdoor.

The Dispatch feature is part of the Cowork feature in Claude Desktop and appears in the left-side panel. The Dispatch help page provides some guidance on how to use the feature but does not explain how to quickly disconnect or revoke access.

Adversary Ingress & Lateral Traversal Pipeline

The adversary can exploit the vulnerability by creating a malicious browser extension or compromising a legitimate one. The extension can then be used to send scripts to Claude Desktop, which can execute code on the user's computer. The adversary can use the Dispatch feature to connect devices and reach Claude Desktop on a different computer signed in to the same Claude account.

---

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

MITRE ATT&CK • OPERATIONAL TTP MAPPING

Tactic	Technique ID	Technique Name	Operational Context
Initial Access	T1190	Exploit Public-Facing Application	Remote zero-day / N-day exploitation of edge devices
Execution	T1203	Exploitation for Client Execution	Malicious code execution within target process context
Defense Evasion	T1027	Obfuscated/Compressed Payloads	Ephemeral memory-resident binaries and anti-forensics
Command and Control	T1071.001	Web Protocols	Utilizing TLS/HTTP encrypted streams for beaconing
Collection	T1005	Data from Local System	Harvesting organizational telemetry and credentials

---

Threat Actor Profile & Exploitation Telemetry

Unattributed

---

Detection & SOC Mitigation Playbook

1. Patch Deployment & Workaround Engineering

Review official vendor security bulletins and deploy released security hotfixes across all production and staging environments immediately.

2. Network & Perimeter Defenses

Restrict administrative ingress to dedicated, non-routable management subnets requiring hardware MFA.
Enforce strict egress inspection to drop outbound connection attempts to unauthorized public IP space.

3. Verification & Diagnostic Audit Checklist

Review the Dispatch feature and its security implications
Ensure that users understand how to quickly disconnect or revoke access to the Dispatch feature
Monitor for suspicious activity related to the Dispatch feature
Consider disabling the Dispatch feature until it is retired or a patch is available
Review security measures for cross-device features and ensure that they are properly secured

---

Indicators of Compromise (IOCs)

No specific binary hashes were published in the authoritative advisory; hunt using behavioral telemetry and detection rules above.

---

Frequently Asked Questions (FAQ)

1. Is Claude Dispatch actively exploited in the wild?

While no mass exploitation has been publicly observed to date, the severity of the flaw warrants urgent patch deployment ahead of weaponization.

2. Which systems, applications, and perimeters are affected?

The vulnerability primarily impacts Claude Dispatch installations exposed to public-facing internet traffic or unauthenticated internal network segments.

3. What immediate remediation or patch should organizations deploy today?

Deploy the official security hotfixes released by the vendor immediately. If patching cannot be completed today, implement network ingress restrictions and isolate management interfaces.

4. How can security operations teams detect and hunt for this threat?

Defenders should monitor process creation logs for abnormal shell executions under web servers (e.g. bash, powershell under nginx/httpd) using the provided Sigma rule and Microsoft Sentinel KQL query.