Claude Desktop
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Vulnerability reported by The Register (Security)Anthropic won't fix Claude Dispatch flaw allowing remote command execution
- Vulnerability reported by Help Net SecurityEmbedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Recent news
Anthropic won't fix Claude Dispatch flaw allowing remote command execution
A flaw in Anthropic's Claude products allows any browser extension able to control Claude Dispatch to make Claude Desktop execute code on the local machine, or on a different machine signed into the same Claude account. No browser exploit is needed and minimal user interaction is required. Anthropic has been aware of the issue since May but will not fix it.
Embedded browsers in five AI coding assistants allow code execution, file theft and address spoofing
Forever Security reported flaws in the embedded browsers of Cursor, GitHub Copilot, OpenAI Codex, VS Code and Claude Desktop, grouped under the name EMBRACE. Impacts include code execution in Cursor, address-bar spoofing in Copilot, and local file reads in Codex, VS Code and Claude Desktop, including SSH keys, .env files and npm tokens. Cursor and Copilot have been fixed, while Codex and VS Code were unpatched at publication.