thehackernews.com
Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users’ Computers
Researchers at Forever Security demonstrated that a malicious browser extension could exploit Claude Dispatch to remotely execute code on a user’s computer via Claude Desktop. The flaw allows an extension on claude.ai to send commands to the desktop app when the user is signed in and Dispatch is enabled, bypassing normal approval prompts. The test installed an npm package that launched Calculator, showing potential for file theft or backdoor installation. Anthropic plans to retire Dispatch by October, [...]