Vulnerability · 2 sources · latest 3h

Anthropic won't fix Claude Dispatch flaw allowing remote command execution

VULNERABILITYAnthropicredteam/daily · 2 sources

Severity: High
Sources: 2

What happened

A design flaw in Anthropic's Claude products lets any browser extension that can control Claude Dispatch cause Claude Desktop to run code on the host, including on another machine signed into the same Claude account. No browser exploit is required and user interaction is minimal. Anthropic has known of the issue since May and has decided not to fix it. Defenders should audit installed browser extensions with access to Claude and treat Claude Desktop sessions on shared accounts as a cross-machine risk until the vendor changes its position. No CVE identifier is stated in the article.

For security analysts · Written by AI from 2 sources · Wrong?

What to do

Review the browser extensions installed in your browser and remove any that can control Claude or Claude Dispatch and that you do not need.
Limit which machines are signed into the same Claude account until the issue is addressed.

Written by AI from the sources, checked against them

Read the full story at the source