ThisBash Escape: a browser extension drives Claude Desktop into running code

01What happened

Forever Security published ThisBash Escape on November 4, 2026, research by Gal Weizman into Claude Dispatch, the feature that lets a phone or browser send instructions to Claude Desktop. Weizman reported it to Anthropic on May 14, 2026. Anthropic called the findings valid on May 19, 2026 and closed the report as a duplicate of an issue it had already found internally, and on October 13, 2026 said Dispatch would be retired, targeting the end of October 2026.

02How it works

Dispatch's interface and API were not linked from claude.ai but were reachable from a logged-in session, and the researchers found the URL inside the desktop app. An extension holding permission to act on claude.ai could use the user's own session to locate the paired Claude Desktop and send it messages that arrive as though the user wrote them, then click the approval buttons itself. Where Claude hesitated, the extension read the reply and sent follow-up messages, a technique Weizman calls prompt forcing. In the proof of concept Claude installed a package that opened Calculator.

03Who is affected

Users running Claude Desktop, an Electron app, with Dispatch enabled and a browser extension that may act on claude.ai. Cross-device dispatch widens the reach: Forever Security says a personal Claude account signed in on a work laptop lets a compromised personal browser reach a corporate endpoint, which the team reports observing in customer environments.

04What to do

Disable cross-device dispatch where it is not needed, and review how devices are paired, authorized and revoked where it is. Treat browser extensions as endpoint software whose permissions and updates deserve review, and stop treating an approval prompt rendered inside an attacker-reachable interface as proof of user consent.

Questions people ask

Is Claude Desktop exposed if no extension can touch claude.ai?

ThisBash Escape starts with a browser extension that holds permission to act on claude.ai, so a browser without one cannot drive this chain. Forever Security places the risk in an extension's permissions rather than its appearance, and notes that an extension's access can grow through an update, which is why the team advises reviewing extension permissions as endpoint software.

Did Anthropic fix the Claude Dispatch flaw?

Anthropic acknowledged Weizman's findings as valid on May 19, 2026 and closed the report as a duplicate of an issue it had already found internally. On October 13, 2026 it said Claude Dispatch would be retired, targeting the end of October 2026. Forever Security describes no separate patch and says the flaw remains exploitable until retirement completes.

How does prompt forcing differ from prompt injection?

Prompt forcing, as Gal Weizman defines it, makes an agent treat a lower-trust component's messages as the user's own, so the attacker can steer a sequence of actions and talk the agent past its hesitation. Prompt injection plants one instruction inside content the agent reads. In ThisBash Escape the extension held the user's session, so its messages carried the user's authority.

Sources 2 links, all fetched

1. 1forever.securityForever Research
2. 2forever.securityPrompt Forcing