ThisBash Turns Claude Browser Sessions Into Desktop Command Channels

Key Takeaways

• Forever Security published ThisBash on November 4, 2026, showing that a browser extension able to script claude.ai could drive Claude Desktop through Dispatch.
• The proof of concept made Claude Desktop install a package that opened Calculator on the same machine.
• Dispatch is built to cross devices, so the researcher says the same path could reach another computer on the same account.
• Anthropic plans to retire Dispatch rather than patch it; the researcher says Remote Control and Cowork share the design.

A Logged-In Browser Tab Becomes a Remote Shell

Claude Dispatch lets users send tasks from a phone or browser to Claude Desktop, an agent that can work with local files and run commands. The Hacker News reported that researchers turned that feature into a path from a browser extension to code execution. Anthropic plans to retire the feature instead of patching it, but the researcher says related features share the same design.

What We Know

Gal Weizman of Forever Security found that Dispatch's interface and API are reachable from an ordinary logged-in claude.ai web session. Any browser extension that can run scripts on that page can therefore send instructions to the Claude Desktop agent paired with the account.

In the demonstration, an extension opened Dispatch in a small, unfocused popup, captured the desktop session ID, and typed prompts as the user. Claude Desktop then invoked Claude Code and installed a package that opened Calculator.

Forever reported the issue to Anthropic on May 14, 2026. The Register reported that Anthropic plans to retire Dispatch rather than fix it. As of late October, Dispatch was in a limited beta, unavailable to new users but active for existing ones.

The Cloud Security Alliance notes that claims about Claude Code Remote Control and Cowork have not been independently reproduced. The cross-device scenario was described, not shown.

What Could Happen

The attack needs two things: an extension that can script claude.ai, and a user signed in to both claude.ai and Claude Desktop with Dispatch enabled. Browser extensions with broad page access are common, and some are malicious or later compromised.

With those conditions met, the extension can issue tasks that Claude Desktop runs with the user's local authority. That could mean reading source code, collecting credentials from the file system, or installing tools.

The cross-device path widens the risk. Forever says it has seen personal Claude accounts with Dispatch enabled on corporate laptops. A malicious extension in a personal browser at home could then reach a work machine linked to the same account.

The research frames the core flaw as a trust assumption. An authenticated web session was treated as proof that the user approved a local command. No real attacks using ThisBash have been reported. The demonstration ran on a single machine.

Why It Matters

Agents are linking devices together. A phone, a browser tab and a desktop now share one session, and the desktop end holds real authority over files, code and credentials.

ThisBash shows what happens when the weakest client in that set can speak for the strongest. Browsers run many third-party extensions, and enterprise surveys find that a majority of users have at least one with high permissions. That makes the browser a poor place to anchor trust for local execution.

The finding also raises a governance issue. Personal AI accounts on managed laptops can open paths that no corporate policy covers, because the features involved are not part of enterprise plans.

Organizations should disable cross-device remote control where it is not needed, restrict personal AI accounts on corporate endpoints, govern browser extension permissions, and monitor processes launched by desktop agents. Retiring one feature should not be treated as closing the design issue.

PointGuard AI Perspective

ThisBash is an agentic endpoint problem. The risky component is a desktop agent with local authority that accepts instructions from a channel outside the organization's control.

PointGuard AI Agentic Endpoint Security discovers AI agents running on employee devices, including desktop assistants signed in with personal accounts, and shows which remote control features are enabled. Policies can block unapproved agents or features, and runtime monitoring flags agent-launched processes such as package installs or credential reads that fall outside normal behavior.

PointGuard AI Agent Identity and Access Security addresses the trust gap behind the flaw. Commands that reach a local agent should carry a verifiable identity and intent, not just a valid session cookie. Binding agent actions to scoped permissions means a hijacked session cannot unlock everything the user can do.

Visibility into which accounts and devices are linked also matters. Security teams cannot manage a cross-device path they do not know exists.

The lesson is that every new agent channel needs the same scrutiny as a remote access tool. If something can tell an agent what to do, it is part of the attack surface. Browser extension governance should be part of the same program, since extensions are the entry point in this attack.

Incident Scorecard Details

Total AISSI Score: 6.05/10

Criticality: 8, Desktop agents hold local code, files and credentials. AISSI weighting: 25%

Propagation: 7, One account can link browsers and several desktop machines. AISSI weighting: 20%

Exploitability: 4, A working proof of concept is public; no observed attacks. AISSI weighting: 15%

Supply Chain: 7, The weakness lies in a vendor's cross-device agent design. AISSI weighting: 15%

Business Impact: 4, No confirmed harm, but a design issue the vendor will not patch. AISSI weighting: 25%

Sources

Third-Party Sources

• The Hacker News: Malicious browser extensions could use Claude Dispatch to run code
• Cloud Security Alliance: ThisBash, browser sessions as remote shells via Claude Dispatch

PointGuard AI Sources

• PointGuard AI Agentic Endpoint Security
• PointGuard AI Agent Identity and Access Security