Disclosed weakness · no CVE recorded

A signed-in browser session could initiate desktop execution through Claude Dispatch

Anthropic · Claude Dispatch and linked Claude Desktop

First documented disclosure · Review checkpoint

Summary

Forever Security demonstrated that an extension controlling a signed-in Claude web session could cause a linked desktop agent to run code the user had not requested.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: Controlled demonstration by the researcher. No actual victim or general post-update reproduction was verified.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Claude displayed an approval prompt, but the browser session that submitted the task could also satisfy that prompt. The linked desktop had no independent confirmation of the user’s consent.

Conditions required

The extension needed access to the signed-in Claude site and a linked desktop environment with Dispatch available.

Potential impact

The demonstrated action ran with the desktop agent's permissions, potentially crossing from a browser session to a separate linked device.

Affected versions and configurations

Dispatch as tested by Forever Security; no affected release range or platform-wide retest was published.

Fix and mitigation status

No issue-specific fixed build verified. A planned retirement at the end of October is not evidence that existing installations were fixed.

Practical next steps

Review which browser extensions can access the signed-in service, and disable an unused desktop connection. Require local confirmation for sensitive actions initiated from another device.

Operating lesson

An authenticated remote session identifies an account; it does not establish approval for a particular desktop action.

Evidence and limits

The researcher reported privately on May 14. Anthropic acknowledged the report as an internal duplicate on May 19. November 4 is the public researcher disclosure. The provider's help center still described access for existing Dispatch users at review time; feature availability alone does not establish continued exploitability.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources