A cybersecurity researcher has discovered a vulnerability in Claude that could allow attackers to force AI to execute commands on a user's computer. A malicious or compromised browser extension could be enough to carry out the attack. Anthropic learned of the issue back in May, but has yet to patch it.
A cybersecurity researcher has discovered a vulnerability in Claude that could allow attackers to force AI to execute commands on a user's computer. A malicious or compromised browser extension could be enough to carry out the attack. Anthropic learned of the issue back in May, but has yet to patch it.
This is reported by The Register, citing research by Forever Security specialist Gal Weitzman.
The issue is related to the Claude Dispatch feature, which allows you to remotely control an AI assistant on your computer — for example, giving it tasks from your phone. Since Claude Desktop can work with a user's files and run commands on their computer, under certain conditions this can be used for an attack.
If a person installs a browser extension that turns out to be malicious or compromised and has access to the Claude website, and the user is logged in to their account and has connected Claude Desktop with Dispatch, the attacker can send AI commands on their behalf. So they can try to force Claude to install malware or read sensitive files.
In addition, if a user has connected a home and work laptop to the same account, an attack through a browser on one device can potentially reach the other.
The researcher found that Claude sometimes even asks for confirmation before performing actions. But the researcher demonstrated that the malicious extension can automatically click the allow button when it appears.
Weitzman reported the vulnerability to Anthropic back in May 2026. The company acknowledged the report as valid, but closed it as a repeat of an already known issue. According to the researcher, Anthropic planned to retire Claude Dispatch by the end of October. However, as of October 30, the feature was still available to some paid users, although it was no longer being offered to new users.
But the researcher warns that even disabling Dispatch won't necessarily solve the problem. According to him, a similar attack method is possible through other Claude features, including Cowork and Claude Code remote control.
The problem is that the web version of Claude can interact with AI agent sessions on the computer. This is convenient for users, but creates an additional path for attackers.
Previously, dev.ua wrote that Forever Security researchers found vulnerabilities in Codex and VS Code that could allow attackers to access developer files, including program code, passwords, and server access keys. OpenAI and Microsoft reported the problems a few months ago, but as of the end of October, they had not fixed them.
