Anthropic declines to patch Claude Dispatch cross-boundary remote code execution flaw

Key facts

Disclosure timeline and vendor inaction

On Thursday 5 November 2026 at 13:00 UTC, technical research disclosures revealed that Anthropic declined to fix a high-severity remote code execution flaw in Claude Dispatch. Dubbed ThisBash by security researcher Gal Weizman of Forever Security, the flaw allows any browser extension with access to claude.ai to bypass browser isolation boundaries and command Claude Desktop to execute arbitrary operating system commands, without exploiting underlying browser memory safety defects.

The disclosure chronology highlights prolonged vendor inaction: Weizman first reported the vulnerability to Anthropic on 14 May 2026. Anthropic validated the issue as a genuine security defect but closed the ticket as a duplicate of an internal flaw, refusing to pay a bug bounty or assign a CVE identifier. Anthropic privately informed the researcher that Dispatch would be retired by the end of October 2026 (170 days post-report, derived). However, that retirement did not occur. On 30 October 2026, Anthropic support pages merely changed Dispatch to a limited beta for existing Pro, Max, and Ultra subscribers, stating that current users could continue using it indefinitely. In total, 175 days elapsed between initial reporting and public disclosure (derived: 6 months, derived).

Responsible disclosure milestones for ThisBash vulnerability

Date	Milestone	Action by Anthropic	Security Posture
14 May 2026	Vulnerability Reported	Validated report; closed as internal duplicate	$0 bounty paid; zero CVE assigned
13 October 2026	Vendor Retirement Pledge	Stated Dispatch would be retired by end of October	Zero patch deployed to active users
30 October 2026	Deadline Missed	Downgraded Dispatch to limited beta; permitted ongoing use	Flaw remains exploitable across existing accounts
5 November 2026	Public Disclosure	Zero public remediation; declined to answer press questions	Shared session flaws persist in Cowork and Code

The six-step ThisBash attack chain

The technical root cause of ThisBash resides in Claude Dispatch treating authenticated web sessions as equivalent execution authorities for local desktop agents. Because Dispatch endpoints are exposed directly to web clients logged into claude.ai, an extension can steer the local operating system through a six-stage attack chain:

Zoom

In Step 1, a browser extension injects a MAIN-world content script into claude.ai, gaining direct access to the application JavaScript context and ambient session cookies. In Step 2, the script spawns the Dispatch agent interface (claude.ai/cowork/agent) within an unfocused 1x1 pixel popup window, representing the sole visible visual artifact of the entire sequence. In Step 3, the script issues an authenticated request to GET /v1/sessions?tags=cowork-dispatch-local, retrieving the active session identifier of the Claude Desktop instance running on the host machine.

In Step 4, the script begins force-prompting, programmatically populating the composer to instruct the agent to inspect local directories and execute shell commands. If the agent hesitates, the script automatically replies with context-rich reassurance prompts until the model complies. In Step 5, the script bypasses human confirmation dialogues by establishing a setInterval loop running every 1,000 milliseconds (1.0 second), automatically clicking the Allow button whenever a prompt appears. In Step 6, the desktop agent executes the payload in the local shell. In the published proof-of-concept, Claude executes npm install -g on a package with a preinstall.js hook, achieving unrestricted code execution on the underlying operating system.

Cross-boundary lateral movement via account sharing

The most critical operational danger of ThisBash is cross-boundary lateral movement. Because Dispatch operates through centralized cloud session routing, commands submitted from one authenticated browser can execute on any desktop instance linked to the same account, regardless of physical machine location.

Zoom

In modern hybrid work models, employees routinely sign into personal Claude accounts on corporate laptops to access custom workflows or subscription features. Under this topology, an attacker who compromises an employee's personal home computer via a malicious or hijacked browser extension can dispatch commands that execute on their enterprise laptop behind corporate firewalls. The attack traverses perimeter defenses without triggering traditional endpoint detection alerts, granting the attacker direct access to corporate source code repositories, SSH keys, and cloud infrastructure tokens.

Personal Claude account penetration across evaluated corporate environments

Organization	Total Claude Accounts	Personal Accounts Detected	Personal Penetration (derived)	Perimeter Exposure Risk
Organization 1	1,233 accounts	255 accounts	20.68%	Lateral bridge from unmanaged home devices
Organization 2	695 accounts	214 accounts	30.79%	Direct exposure to extension supply chain hijacks
Organization 3 (Peak)	28 accounts	20 accounts	71.43%	Substantial majority of accounts unmanaged

Forever Security confirmed that personal account penetration is widespread across enterprise fleets, ranging from 18.0 percent to 71.4 percent of active accounts (derived). This exposure scales across a massive user base: Anthropic reported that claude.ai receives approximately 950 million monthly web visits, while Claude Cowork recorded 1.2 million sampled sessions across more than 600,000 organizations during May 2026 (derived: 2.0 sessions per organization).

Architectural design flaws and defensive controls

Security researchers emphasized that retiring Dispatch alone does not eliminate the security vulnerability. The core flaw is an architectural choice that permits low-privilege web browser sessions to steer high-privilege local terminal execution. Newer features in the Claude ecosystem perpetuate this identical design:

Zoom

Claude Cowork sessions and Claude Code Remote Control continue to share state between web interfaces and desktop runtimes, enabling web scripts to command local execution environments. Researchers contrasted Anthropic's shared session architecture with OpenAI Codex. In Codex, sessions initialized on desktop environments cannot be accessed, viewed, or manipulated from web sessions, enforcing a strict privilege boundary that eliminates the extension-to-OS injection pathway entirely.

Recommended enterprise defensive controls for agentic terminal execution

Control Domain	Technical Implementation	Mitigation Impact	Operational Priority
Browser Extension Governance	Enforce enterprise extension whitelists; block unvetted extensions on claude.ai	Eliminates injection vectors for MAIN-world content scripts	Immediate (Priority 1)
Account Boundary Enforcement	Prohibit personal Claude accounts on corporate laptops via SSO federation	Breaks lateral movement bridge between home and office	Immediate (Priority 1)
Agent Runtime Isolation	Execute Claude Desktop and Claude Code inside sandboxed micro-VMs (gVisor/Firecracker)	Prevents terminal commands from accessing ambient credentials	Short-term (Priority 2)
Network Traffic Monitoring	Alert on outbound API requests to /v1/sessions?tags=cowork-dispatch-local	Detects automated session enumeration attempts	Short-term (Priority 2)

With Anthropic maintaining Dispatch in active beta and offering zero security patch, enterprise security teams must treat connected AI desktop agents as high-risk execution surfaces. When software vendors invent novel interaction models that dissolve traditional browser sandbox boundaries, enterprise defenders must enforce strict policy boundaries at the perimeter.