Claude Dispatch design flaw let malicious browser extensions run commands on remote computers
VULNERABILITYAnthropicredteam/daily · 2 sources
- Severity
- High
- Sources
- 2
What happened
Forever Security researchers disclosed a design flaw in Anthropic's Claude Dispatch feature, dubbed ThisBash. Dispatch accepted instructions from a standard logged-in claude.ai session, so a malicious browser extension able to control that site could execute operating system commands, including on a different computer. The articles provided do not list affected versions, CVE identifiers or an official fix. Defenders should review installed browser extensions and monitor for the Dispatch feature until an vendor fix is confirmed.
For security analysts · Written by AI from 2 sources · Wrong?
What to do
- Remove browser extensions that you do not recognise or do not trust.
Written by AI from the sources, checked against them
Full story timeline · 2 updates
Who reported · 2 outlets
Cyber Security NewsGBHackers
Who and what is in it
Companies
Products