thehackernews.com
Nov 7, 2026
Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users’ Computers
AI-summarised brief · reviewed before publication
Researchers at Forever Security demonstrated that a malicious browser extension could exploit Claude Dispatch to remotely execute code on a user’s computer via Claude Desktop. The flaw allows an extension on claude.ai to send commands to the desktop app when the user is signed in and Dispatch is enabled, bypassing normal approval prompts. The test installed an npm package that launched Calculator, showing potential for file theft or backdoor installation. Anthropic plans to retire Dispatch by October, but similar features remain.
💡 Why It Matters
- · The vulnerability exposes a new vector for remote code execution that bypasses traditional browser sandboxing, underscoring the need for tighter controls on AI‑driven desktop integrations.
