Researchers Show Browser Extension Could Hijack Claude Desktop Through Dispatch Feature

Researchers at endpoint security company Forever Security showed in a test that a browser extension able to run scripts on claude.ai could make Claude Desktop run code on a person's computer. The attack relies on Dispatch, a feature that lets people send tasks from their phone to Claude Desktop. The researchers found that Dispatch also accepted an ordinary signed-in session on claude.ai, even though the site showed no link to it. This let an extension send instructions as if the user had sent them. They say the flaw can still be exploited.

The attack needs an extension that can run scripts on claude.ai, and a user signed in to both claude.ai and Claude Desktop with Dispatch turned on. The extension could be malicious, a legitimate one that received a compromised update, or one with a security flaw. In the test, a script sent four prompts asking Claude to install an npm package. Claude hesitated at first, but a follow-up message in the user's voice persuaded it to proceed. The approval prompts appeared in the web page the extension controlled, and the script clicked "Allow" every second, so nobody needed to be watching. The package's install script then opened the Calculator app. The researchers say the same step could have stolen files or installed a backdoor.

The researchers say Anthropic told them on October 13 that Dispatch would be retired, with end of October as the target. However, the help page does not mention retirement. It says Dispatch is closed to new users, and existing users on some Pro, Max, and Ultra plans "can keep using it for now."