Forever Security ThisBash: Browser Extension Can Drive Claude Desktop RCE via Dispatch, Even Cross-Machine

Core Background & Industry Pain Points

Once a desktop coding agent can run local commands, browser extensions plus cross-device dispatch become a new trust boundary. On 2026-11-04, Forever Security researcher Gal Weizman published ThisBash: an extension that can control claude.ai can abuse Claude Dispatch to escalate a web session into local—or cross-machine—code execution. The Hacker News and The Register followed on Nov 5–6. Security research disclosure, not an Anthropic product announcement.

Architecture Highlights & Internals

Dispatch is meant to send phone tasks to Claude Desktop. Researchers found its UI/API also accepted an ordinary signed-in claude.ai session. An extension opens /cowork/agent with the user's cookies, fetches the local session id, submits prompts in the user's voice, and interval-clicks Allow. They call this prompt forcing: the attacker owns the input channel and can push past hesitation.

Authoritative Benchmarks & Measured Scores

Forever Security PoC (researcher numbers; no public CVE): four prompts drove a global npm install -g whose preinstall opened Calculator; no in-the-wild attacks reported. Cross-machine and personal-account-on-work-laptop paths are described, not fully demoed. Timeline: reported 2026-05-14; Anthropic validated 05-19 as a duplicate; on 10-13 said Dispatch would retire by end of October. As of THN 2026-11-06, the help page still lets existing users keep it.

Developer Hands-on Guide

Turn off cross-device Dispatch when unused; review pairing/revocation; govern extensions like other endpoint software; watch agents for unexpected installs and egress. Authors warn retiring Dispatch does not remove the design where an authenticated web session can drive a local agent; they flag Remote Control and Cowork as the same pattern. Cite Forever Security / press—not an Anthropic advisory.