Claude Dispatch: browser extensions run desktop code

A signed-in page on claude.ai is enough for a browser add-on to hand work to Claude Desktop. Forever Security, an endpoint-security company, walked through that path this week. The hinge is Dispatch, the Claude feature that forwards a task from another device to the desktop agent. Gal Weizman wrote the lab note. The firm says the path is still open.

Claude Desktop can act on the computer where it is installed. Dispatch was meant to let a phone session hand that agent a job. Forever Security found an ordinary web session was accepted too, on a site that shows no Dispatch control of its own. An extension in that page can file tasks as the user. The desktop app has to be open, and the computer has to be awake.

The demonstration needed script access on claude.ai and one account signed in on both the site and Claude Desktop, with Dispatch enabled. The add-on in that seat can be hostile from the start, a trusted add-on after a bad update, or a legitimate add-on with a flaw of its own. The agent asked before it acted. Those approval prompts were drawn in the page the extension already controlled, so the work continued from the page. Forever Security says the same position could read files or change the machine, because the agent holds the user’s rights there. The prompts and the lab package stay in the research note.

One login, two computers

The published test kept the browser and Claude Desktop on a single machine. Dispatch is built to cross devices, and the researchers describe a second case they left undemonstrated: an extension in a browser on one computer reaching Claude Desktop on another computer under the same account. They have also seen personal Claude accounts, with cross-device Dispatch on, sitting on work laptops at customer sites. A home browser and an office agent on one login are the same channel.

Forever Security reported the issue to Anthropic on May 14. Anthropic accepted it on May 19 and closed the report as a duplicate of a problem found inside the company. On October 13, Anthropic told the researchers Dispatch would be retired, with the end of October as the target. The Dispatch help page, refreshed late last week, says the feature is closed to new users and that people who already have it on some Pro, Max, and Ultra plans can keep using it for now. A shutdown date is absent from that page.

The researchers argue that a Dispatch retirement would leave the design standing. They name Claude Code Remote Control and Claude Cowork sessions as two features an extension could use the same way. They have not published a test of either, and they say a follow-up is coming. Watch those names. Dispatch is the one with a public demonstration.

What to change this week

Turn cross-device Dispatch off unless the team has a written reason to keep it. Where someone still needs it, list the paired devices, who approved them, and how a device gets removed. Anthropic’s help page says to learn how to disconnect or revoke access before the feature is switched on. Learn that control on a machine you own before it stays enabled on a work laptop.

Treat extensions that can script claude.ai as software that acts as the user. An allow list beats a store search. Review updates that add host access to the Claude site. A personal browser profile on a corporate laptop is still in scope.

Watch the agent. An install, a settings change, a read of credentials, or a connection the user did not start is the incident, whatever route delivered the task. Keep work Claude accounts off personal browsers, and keep personal Claude accounts off work machines. One login is what ties the home extension to the office desktop.

This briefing relies on public reporting by The Hacker News and on Forever Security’s disclosure.