When a user installs a seemingly harmless browser tool to adjust their screen brightness or correct their grammar, they rarely suspect it could serve as a gateway for a remote attacker to seize control of their local file system. Most users treat their web browser and desktop applications as two separate worlds, assuming a wall exists between a website and their local files. However, security researchers have discovered a bridge in the form of Claude Dispatch that effectively tears this wall down. By exploiting this connection, a simple browser extension can transform from a helpful tool into a remote terminal capable of executing unauthorized commands directly on your operating system.
The discovery by security professionals highlights a shift in the threat landscape where productivity features become liabilities. The ability for an extension to jump from the sandbox of a browser into the core of a PC represents a significant escalation in risk. This vulnerability is not merely a theoretical exercise but a demonstrated path to total system compromise. As AI agents gain more agency over local environments, the security of the interfaces connecting these agents to the web becomes the most critical point of failure in modern computing setups.
The Invisible Bridge: Between Your Browser and Your Desktop
Claude Dispatch was designed as a convenience feature to allow users to seamlessly send prompts from their mobile devices or web browsers to the Claude Desktop application. This desktop agent is granted high-level permissions to interact with the host computer’s file system and execute terminal commands. Researchers at Forever Security identified that this synchronization mechanism lacks the necessary isolation to prevent third-party scripts from hijacking the communication channel. Because the desktop agent is built to be an action-oriented AI, it can install software, run scripts, and modify settings—tasks that it assumes are being requested by the legitimate owner.
The synchronization flaw allows for a cross-platform jump that bypasses traditional security boundaries. While the browser is designed to keep web scripts isolated from the local machine, the Dispatch feature creates a tunnel where those scripts can impersonate the user. This design assumes that any message arriving through the Dispatch channel is authenticated and intentional. Unfortunately, this trust model fails to account for the possibility that the browser side of the connection could be controlled by a malicious extension rather than a human being.
Understanding the Claude Dispatch Vulnerability
The core of this security concern lies in how the ecosystem synchronizes tasks across different environments. The researchers found that Dispatch accepted an ordinary signed-in session on the web interface, even if no visible link to the feature was displayed to the user. This meant that a script running in the background could open the Dispatch channel without the user ever seeing a change in their interface. Because the AI is optimized for helpfulness, it is predisposed to follow instructions that appear to come from the authorized account owner.
This vulnerability was reported as early as May, yet the mechanism for exploitation remains a concern for many users. Anthropic indicated plans to retire Dispatch by the end of October, but current support documentation suggests the feature remains active for many professional and enterprise tiers. This persistent availability means that users on high-level plans continue to carry a risk that many assume has already been mitigated. The disconnect between reported retirement dates and the actual availability of the feature complicates the security posture for many organizations.
The Anatomy: A Cross-Platform Hijack
The execution of this attack does not require a sophisticated browser exploit or a zero-day vulnerability in the operating system; instead, it leverages the intended functionality of the AI agent against the user. The attack begins with a malicious or compromised browser extension that has permission to run scripts on the AI platform’s domain. The extension injects a script into the user’s active session, sending prompts to the Dispatch feature that mimic user input so perfectly that the system cannot distinguish between a human typing and a bot-generated command.
While Claude is designed to ask for permission before executing sensitive actions, researchers found a clever workaround to bypass human consent. Since the approval prompts appear within the web interface, the malicious script can automatically click the Allow button every second. In a documented test, the script commanded the AI to install a global npm package. Once installed, the package executed code that opened local applications and could have easily been used to exfiltrate sensitive data or establish a persistent backdoor on the machine.
Expert Insights: The Cowork Security Model
Security analysts argue that the risk extends beyond a single feature. Although there is movement toward retiring Dispatch, the researchers warn that the underlying design philosophy remains in other features like Claude Code Remote Control and Claude Cowork sessions. Anthropic is retiring the specific Dispatch tool, but the design behind it—allowing a web interface to trigger desktop actions—is still very much alive. This suggests that any feature allowing a web-to-desktop handoff creates a permanent surface for extension-based attacks.
This is particularly concerning in corporate environments where users might link personal AI accounts and their associated extensions to managed work laptops. This inadvertently creates a pathway for malware to jump from a personal browser to a corporate network. The Cowork security model assumes that the authenticated session is a safe zone, but in reality, it is a shared space where any extension with site access can act as the user. This flaw highlights the dangers of integrating powerful AI agents directly into the operating system without hardware-level verification.
Practical Defenses: Secure AI Workflows
To mitigate the risks associated with AI agents that have hands on a computer, users and IT administrators should adopt a more rigorous security posture regarding browser and desktop integration. The first step involves a strict audit of all browser extension permissions, treating every plugin with the same scrutiny as an executable file. Extensions that have permission to read and change data on AI platforms should be minimized or removed if they are not from a verified and trusted source.
If cross-device synchronization is not explicitly required for a specific workflow, users should immediately disable Dispatch and Cowork features within the desktop settings. Isolating AI environments by avoiding the use of personal accounts on professional devices prevents a compromised personal extension from gaining access to a high-value work environment. Furthermore, keeping a close watch on the activity logs for any AI desktop application can help catch unexpected requests for elevated permissions or unauthorized package installations before they cause permanent damage.
The security landscape evolved as users began treating their AI agents with the same caution as administrative accounts. Organizations implemented zero-trust architectures that treated browser-based inputs as inherently untrusted, regardless of the AI’s perceived intelligence. This proactive shift toward isolation and rigorous auditing turned a critical vulnerability into a foundational lesson for the next generation of integrated software design. Security professionals recognized that as AI systems became more capable, the barriers between the web and local environments required reinforcement rather than removal.
