As cited
Copy frozen at (site build).
vulnerabilities
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries
Anthropic's Claude Dispatch feature allows browser extensions to hijack web sessions and send commands to Claude Desktop or other Claude instances running on the user's machine or networked computers with minimal user interaction required. Security researcher Gal Weizman discovered the flaw in May and disclosed it to Anthropic, which acknowledged it as valid but took no action; the company stated it would retire Dispatch by October, which did not occur, and the underlying design vulnerability persists in related features like Claude Code Remote Control and Claude Cowork. An attacker with a malicious browser extension can escalate privileges to execute remote code on local or networked systems, potentially crossing from personal to corporate environments if users share Claude accounts across devices.
Why it matters: Organizations with Claude Desktop users, employees sharing Claude accounts across personal and corporate devices, and anyone with Claude browser extensions installed face potential remote code execution and lateral movement into corporate networks; practitioners should audit Claude Dispatch deployments, enforce device-level security policies, and monitor for malicious extension installations.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries
Anthropic's Claude Dispatch feature allows browser extensions to hijack web sessions and send commands to Claude Desktop or other Claude instances running on the user's machine or networked computers with minimal user interaction required. Security researcher Gal Weizman discovered the flaw in May and disclosed it to Anthropic, which acknowledged it as valid but took no action; the company stated it would retire Dispatch by October, which did not occur, and the underlying design vulnerability persists in related features like Claude Code Remote Control and Claude Cowork. An attacker with a malicious browser extension can escalate privileges to execute remote code on local or networked systems, potentially crossing from personal to corporate environments if users share Claude accounts across devices.
Why it matters: Organizations with Claude Desktop users, employees sharing Claude accounts across personal and corporate devices, and anyone with Claude browser extensions installed face potential remote code execution and lateral movement into corporate networks; practitioners should audit Claude Dispatch deployments, enforce device-level security policies, and monitor for malicious extension installations.
- Source published
- First seen by Cybersecurity Tracker