Affected Systems
Anthropic Claude Desktop users with Dispatch feature enabled on Pro, Max, and Ultra plans. Requires user signed into both claude.ai web and Claude Desktop, with a malicious or compromised browser extension running scripts on claude.ai domain.
Exploitation Status
Proof-of-concept demonstrated by Forever Security researchers. No active exploitation reported in the wild. Vulnerability remains exploitable as of publication. Anthropic acknowledged the issue as a duplicate of internal finding on May 19, 2026.
Business Impact
Attackers with a malicious browser extension on claude.ai can execute arbitrary code on Claude Desktop with user-level permissions, enabling data exfiltration, backdoor installation, or lateral movement. Risk amplified in environments where users sign into personal Claude accounts on corporate devices with cross-device Dispatch enabled. Approval prompts can be automatically bypassed by extension scripts. Similar attack surface exists in Claude Code Remote Control and Claude Cowork sessions per researchers.
Urgency
🟠Within 24 hours
Recommended Actions
- Disable Dispatch feature in Claude Desktop immediately if not required for business operations
- Audit all corporate endpoints for personal Claude accounts with cross-device Dispatch enabled and enforce account separation policy
- Review and restrict browser extension permissions on devices running Claude Desktop, particularly extensions with access to claude.ai domain
- Monitor Claude Desktop activity logs for unexpected npm package installations, credential access attempts, or unauthorized system commands
- Block or restrict Claude Desktop installation on corporate endpoints until Anthropic retires Dispatch and addresses similar attack vectors in Claude Code Remote Control and Cowork features