Some security stories are loud because of the exploit. This one is loud because of the argument around it. A researcher says he found a way to turn a browser extension into a remote control for someone's desktop AI agent. A news outlet says the vendor isn't going to fix it. And the vendor's own plan, as far as anyone can tell, is to switch the feature off.
I have spent the last day reading the original research, the coverage that followed and the little public documentation that exists. What follows is my attempt to separate what is established from what is merely being repeated, and to tell you what to do if you use Claude on a work machine.
What Is Claude Dispatch?
Dispatch is an Anthropic feature that lets you send instructions from your phone to Claude Desktop, an agent that can work with files, apps and commands on your computer. The idea is simple and genuinely handy: you are out, you fire off a task, and the work happens on the machine at home or at the office.
That convenience is exactly why the feature matters to security teams. A chat window that can only talk is one thing. A chat window that can install software and run commands is another.
What the Researchers Say They Found
The research comes from Forever Security, a security company, and was published on November 4 by researcher Gal Weizman. The team named the attack ThisBash.
Here is the core of it, in plain language. Claude Desktop is built on much of the same web interface and API as the claude.ai website. The website simply did not show a link to Dispatch, but according to the researchers, the service still accepted Dispatch requests from an ordinary logged-in browser session. Hiding a link, in other words, is not the same as locking a door.
That matters because browser extensions can often act inside the pages you are logged into. The researchers say an extension with access to claude.ai could reach Dispatch through the user's own session and send instructions to the desktop agent as though the user had typed them. In their demonstration, the agent hesitated at first, was nudged along by follow-up messages written in the user's voice, and ended up running a harmless test payload that opened the Calculator app.
Two details stand out. First, the researchers did not find a flaw in the direct phone-to-desktop connection itself. Second, because Dispatch links devices, the computer running the extension and the computer receiving the commands do not have to be the same one.
The Timeline, As Reported
| Date | What happened | Source |
|---|---|---|
| May 14, 2026 | Forever Security reports the issue to Anthropic | Forever Security |
| May 19, 2026 | Anthropic acknowledges the findings as valid but closes the report as a duplicate of an issue it had already found internally | Forever Security |
| Oct 13, 2026 | Anthropic says Dispatch will be retired, targeting the end of October 2026 | Forever Security |
| Nov 4, 2026 | Forever Security publishes its ThisBash write-up | Forever Security |
| Nov 5, 2026 | The Register reports that Anthropic will not fix the flaw | The Register |
| Nov 6, 2026 | Follow-up coverage says Dispatch is closed to new users, though existing users can still use it | GBHackers |
"Won't Fix" or "Retiring"? What Is Actually Confirmed
This is where I would slow down. The headline version, "Anthropic won't fix it," is catchy, but the paper trail is more nuanced. A vendor that plans to remove a feature may well decline to patch it, and both statements can be true at once. What I could not find is a public, on-record Anthropic statement spelling out its position. The Register's full article was not something I could read in full, so I am relying on its published summary and on the researchers' own account.
| Claim | Status | Basis |
|---|---|---|
| Dispatch sends tasks from a phone to Claude Desktop | Confirmed | Anthropic documentation, as cited by multiple outlets |
| A browser extension could reach Dispatch through a claude.ai session | Reported by researchers, with proof of concept | Forever Security |
| Anthropic acknowledged the report in May 2026 | Reported by researchers | Forever Security |
| Anthropic plans to retire Dispatch | Reported, retirement not yet verified as complete | Forever Security, GBHackers |
| Anthropic will not fix the flaw | Reported, no on-record statement found | The Register |
| A CVE number or affected-version list | None found | No public listing located |
The 3 Plans in Play
You will see "3 plans" in some coverage, and it is worth being precise. One analysis of the story says Dispatch was in limited beta on some Pro, Max and Ultra plans, and was unavailable to new users as of November 2. The same analysis says Dispatch was not offered on Team or Enterprise plans, and that Remote Control was off by default on those workspaces. I could only find that breakdown in a single source, so treat it as indicative rather than final.
| Plan | Dispatch availability (per one analysis) | What it means in practice |
|---|---|---|
| Pro | Limited beta on some accounts | Individuals, often on personal devices |
| Max | Limited beta on some accounts | Power users and freelancers |
| Ultra | Limited beta on some accounts | Heavy agent users |
| Team | Not available; Remote Control off by default | Lower exposure if admins keep defaults |
| Enterprise | Not available; Remote Control off by default | Lower exposure if admins keep defaults |
Here is the catch, and it is the part the researchers keep coming back to. A company can lock down its own Team or Enterprise workspace and still have a problem, because employees sign in to personal accounts on work laptops all the time. Forever Security says it has seen personal Claude accounts with cross-device Dispatch enabled on corporate endpoints in customer environments. In that setup, a compromised browser at someone's home could point toward a managed work computer without any admin ever being involved.
Why This Is Bigger Than One Feature
The researchers argue that retiring Dispatch does not remove the underlying design problem. They claim other Claude features that let the web drive a local agent, such as Claude Code Remote Control and Cowork sessions, can be abused the same way, and they have promised a follow-up post. That claim is theirs, not something I have independently tested, and I would wait for that follow-up and for Anthropic's reply before drawing conclusions.
What I can say is that the pattern is credible. Browser extensions are everywhere in workplaces. The researchers cite a 2025 LayerX report finding that 99% of enterprise users had at least one extension installed and 53% had extensions with high or critical permissions. When something that powerful sits next to an AI agent that can run commands, the line between "can read a web page" and "can run code on my laptop" gets uncomfortably thin.
What You Should Do Right Now
If you use Claude on your own
- Check whether Dispatch or any remote-control feature is switched on, and turn it off if you do not use it.
- Review your browser extensions. Remove anything you do not recognise or no longer need, and be wary of extensions that ask for access to every site.
- Do not click "Allow" on an agent request you did not start yourself.
If you manage a team
- Find out which AI agents and which Claude accounts (personal or company) are in use on your machines.
- Switch off cross-device Dispatch wherever there is no clear business need.
- Keep personal and work Claude accounts separate, so a compromised home browser cannot reach a managed laptop.
- Treat browser extensions like any other endpoint software: control installs and review permission changes.
- Watch what agents do on endpoints, especially unexpected package installs, credential access and outbound connections.
My Take: The Real Story Is the Trust Gap
I have covered enough technology stories to know the pattern. A feature ships fast, the security model catches up later, and a researcher shows the gap in public. What is different about AI agents is the size of the gap. When software can act for you, the question that matters is no longer only "who is logged in?" but "did this person actually ask for this?"
I also want to be fair to Anthropic. Closing a report as a duplicate means the company says it already knew, and winding down a feature is a legitimate way to remove a risk. But "we are retiring it" is only a complete answer if retirement actually happens, on a clear date, with users told plainly. As of this morning, existing users can reportedly still use the feature. A short, direct statement from the company would settle most of this. Until it arrives, the sensible move for readers is to assume the exposure is live and act accordingly.
The Bottom Line
The Claude Dispatch story comes down to three things. A researcher has published a working demonstration that a browser extension could drive a desktop agent through Dispatch. Anthropic reportedly knew about the issue and plans to retire the feature, while a major outlet says there will be no fix. And a patch, a CVE or a firm retirement confirmation has not been publicly verified. Until that changes, limit your exposure: turn off what you do not use, separate your accounts and watch your extensions.
This article will be updated if Anthropic issues an official statement. Details are based on public reporting available on November 6, 2026.
Frequently Asked Questions
What is the Claude Dispatch flaw?
Has Anthropic fixed the Claude Dispatch flaw?
Which Claude plans are affected?
Can new users still turn on Dispatch?
Does the attack need a browser exploit?
How can I protect myself and my company?
Is there a CVE number for this issue?
Sources and Further Reading
- Forever Security (Gal Weizman), "ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS," November 4, 2026 - forever.security
- The Register (Jessica Lyons), "Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries," November 5, 2026 - theregister.com
- GBHackers, "Claude AI Flaw Lets Malicious Browser Extensions Execute Commands on Remote Computers," November 6, 2026 - gbhackers.com
- Tech Insider, "Claude Dispatch Flaw Report: Fix Unconfirmed," November 5, 2026 - tech-insider.org