# ThisBash Escape: a browser extension drives Claude Desktop into running code

> Claude Dispatch turned an ordinary browser extension into local code execution on the machine running Claude Desktop.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability, Attack
- **Published by:** Forever Security
- **Disclosed:** 2026-11-04
- **Affects:** Claude Dispatch, Claude Desktop
- **Research by:** Gal Weizman
- **Primary source:** https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce
- **Page:** https://theinjection.dev/items/forever-thisbash-claude-dispatch-escape/

Claude Dispatch let a browser extension with access to a claude.ai session send instructions to Claude Desktop, approve them and run code on the computer, Forever Security reports. Anthropic is retiring Dispatch.

## What happened

Forever Security published ThisBash Escape on November 4, 2026, research by Gal Weizman into Claude Dispatch, the feature that lets a phone or browser send instructions to Claude Desktop. Weizman reported it to Anthropic on May 14, 2026. Anthropic called the findings valid on May 19, 2026 and closed the report as a duplicate of an issue it had already found internally, and on October 13, 2026 said Dispatch would be retired, targeting the end of October 2026.

## How it works

Dispatch's interface and API were not linked from claude.ai but were reachable from a logged-in session, and the researchers found the URL inside the desktop app. An extension holding permission to act on claude.ai could use the user's own session to locate the paired Claude Desktop and send it messages that arrive as though the user wrote them, then click the approval buttons itself. Where Claude hesitated, the extension read the reply and sent follow-up messages, a technique Weizman calls prompt forcing. In the proof of concept Claude installed a package that opened Calculator.

## Who is affected

Users running Claude Desktop, an Electron app, with Dispatch enabled and a browser extension that may act on claude.ai. Cross-device dispatch widens the reach: Forever Security says a personal Claude account signed in on a work laptop lets a compromised personal browser reach a corporate endpoint, which the team reports observing in customer environments.

## What to do

Disable cross-device dispatch where it is not needed, and review how devices are paired, authorized and revoked where it is. Treat browser extensions as endpoint software whose permissions and updates deserve review, and stop treating an approval prompt rendered inside an attacker-reachable interface as proof of user consent.

## Quick facts

- **Affected:** Claude Dispatch with Claude Desktop, where a browser extension can act on claude.ai
- **Attack type:** Extension to agent control through a shared session, then code execution via approved tool use
- **CVE:** None assigned
- **Found by:** Gal Weizman, Forever Security
- **Disclosed:** Reported May 14, 2026; published November 4, 2026
- **Status:** No separate patch: Anthropic is retiring Claude Dispatch, targeted for the end of October 2026
- **Also noted:** Forever Security says the same design reaches Claude Code Remote Control and Claude Cowork sessions

## Questions

### Is Claude Desktop exposed if no extension can touch claude.ai?

ThisBash Escape starts with a browser extension that holds permission to act on claude.ai, so a browser without one cannot drive this chain. Forever Security places the risk in an extension's permissions rather than its appearance, and notes that an extension's access can grow through an update, which is why the team advises reviewing extension permissions as endpoint software.

### Did Anthropic fix the Claude Dispatch flaw?

Anthropic acknowledged Weizman's findings as valid on May 19, 2026 and closed the report as a duplicate of an issue it had already found internally. On October 13, 2026 it said Claude Dispatch would be retired, targeting the end of October 2026. Forever Security describes no separate patch and says the flaw remains exploitable until retirement completes.

### How does prompt forcing differ from prompt injection?

Prompt forcing, as Gal Weizman defines it, makes an agent treat a lower-trust component's messages as the user's own, so the attacker can steer a sequence of actions and talk the agent past its hesitation. Prompt injection plants one instruction inside content the agent reads. In ThisBash Escape the extension held the user's session, so its messages carried the user's authority.

## Sources

1. [Forever Research](https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce)
2. [Prompt Forcing](https://forever.security/blog/prompt-forcing)