Technology news and discussion on TalkFuse.
Claude flaw could let malicious extensions run commands on linked machines
A vulnerability in Anthropic’s Claude products could let a browser extension with access to claude.ai send commands to Claude Desktop, potentially running code on the computer or another machine using the same account. Researcher Gal Weizman says the flaw, which Anthropic has known about since May, reflects a broader design weakness that may also affect Claude Cowork and Code Remote Control.
The attack requires a user to be signed in to Claude on the web and to have a suitably accessible desktop or remote session; a malicious extension could be installed through deception or by hijacking a legitimate one. Anthropic acknowledged Weizman’s report as valid but closed it as a duplicate, did not issue a CVE or bounty, and said it planned to retire Dispatch by the end of October. On 30 October, its support page still described Dispatch as available to some existing subscribers, while the article says the underlying risk may persist in other features.
In short
- A browser extension could use Claude sessions to run commands on a computer.
- Anthropic acknowledged the flaw in May but did not fix it.
- The researcher says related Claude features may share the design weakness.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The report supports concern that a web extension able to interact with Claude could cross into desktop or remote sessions and run commands, creating a serious risk for users who are signed in and have those features accessible. The researcher’s argument is that the possible reach beyond Dispatch points to a broader design weakness, and that closing the report as a duplicate without a public vulnerability identifier or bounty may leave users and researchers with too little clarity about remediation.
The case against
The attack depends on several conditions: a user must be signed in, a malicious extension must gain suitable access, and a desktop or remote session must be reachable. Anthropic acknowledged the report and said it planned to retire Dispatch, so it could reasonably view the issue as already tracked or being addressed; the available account does not establish that the same vulnerability affects other features or that the planned retirement failed to reduce the risk.
Read the full article at the source →
Originally published by The Register as “Anthropic won’t fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries”.