Claude Dispatch Abused by Malicious Browser Extensions to Execute Code Locally
Researchers at endpoint security firm Forever Security have demonstrated that a malicious browser extension capable of running scripts on claude.ai can leverage Claude Dispatch to execute arbitrary code on a user's computer. The finding, reported by The Hacker News, highlights how AI assistant features that bridge devices can become a fresh attack surface for local code execution.
What Is Claude Dispatch?
Dispatch is a Claude feature that lets users send tasks from their phone to Claude Desktop. It is designed for convenience: a user can fire off an instruction on mobile and have the desktop application carry it out. That cross-device workflow, however, creates a trust path between the browser context on claude.ai and the desktop agent that executes tasks.
The Attack Chain
The researchers showed that a browser extension with the ability to run scripts on claude.ai could abuse that trust path. In the demonstrated test, the extension was able to make Claude Desktop run code on the person's computer. The essential ingredients are:
- A malicious or compromised extension with script execution rights on claude.ai.
- Dispatch enabled on the victim's account, linking mobile task submission to the desktop client.
- The desktop client's task execution capability, which turns a submitted instruction into local action.
Because the extension operates inside the browser session, it can interact with the claude.ai page in ways the user does not see. The result is a chain that starts with a seemingly ordinary extension and ends with code running on the endpoint.
The Underlying Flaw Remains Exploitable
According to the researchers, the flaw that makes this chain possible can still be exploited. Their disclosure underscores a recurring problem in AI-assisted workflows: features that intentionally blur the boundary between cloud services and local machines are difficult to secure, and any weakness in that boundary can be amplified by other software running in the same context.
Why Browser Extensions Are a Potent Vector
Browser extensions are a well-known source of risk. They frequently request broad permissions, are often installed once and forgotten, and can be updated silently by their developers. An extension that can inject scripts into a sensitive page such as claude.ai effectively gains a foothold in an authenticated session. When that session is connected to a desktop agent, the extension's reach extends beyond the browser.
The attack also illustrates a broader pattern: as AI assistants gain the ability to take actions on a user's behalf, the security of those assistants depends not only on the model or the vendor's infrastructure, but also on every piece of software that shares the same browser context.
Mitigation and Hygiene
While the researchers have not described a full patch timeline in the summary, the practical takeaways for defenders are clear:
- Audit installed extensions. Remove anything unnecessary, especially extensions with script-injection or broad host permissions.
- Review Dispatch usage. If Dispatch is not needed, disable it. If it is, understand which devices and accounts are linked.
- Apply least privilege to browser extensions. Restrict extensions to specific sites rather than granting access to all sites.
- Monitor endpoint behavior. Unexpected process execution originating from the desktop client should be treated as suspicious.
- Keep clients updated. Watch for vendor guidance and updates addressing the reported flaw.
The Bigger Picture
This research adds to a growing body of work showing that AI agent features are a meaningful attack surface. The combination of browser-based script execution and desktop task automation creates a bridge that attackers can cross. Organizations deploying AI assistants should treat them as privileged software, inventory the extensions that can interact with them, and apply the same scrutiny they would to any tool with local execution capability.
For security teams, the lesson is that trust boundaries in AI tooling are only as strong as the weakest component in the chain. A browser extension is a small piece of software, but in this case it was enough to turn a convenience feature into a code execution path.
Source: The Hacker News
