Your Browser Extension Just Got a Shell

For about twenty years we’ve told people the browser is a sandbox. A bad extension could steal your cookies or read your webmail. Nasty. It couldn’t open a terminal on your laptop.

It can now.

Gal Weizman at Forever Security found that any browser extension with access to claude.ai can drive Claude Desktop through Dispatch. Dispatch is the feature that lets you fire tasks at the Claude agent on your computer from your phone or a browser tab. The extension doesn’t need an exploit. It uses the session you’re already logged into, tells the agent on your desktop to install a package or run a command, and the agent does it. The Register has the full story.

Anthropic accepted the report in May. Then it closed it as a duplicate of something it was already tracking. No bounty. No CVE. It told Weizman Dispatch would be retired at the end of October, and as of October 30 its own support page still had Dispatch running for existing users. Anthropic didn’t answer The Register’s questions either.

I don’t much care that it’s Anthropic. Every vendor racing to put an agent on your desktop is making the same trade, and most of them will make the same mistake.

Six steps, none of them clever

Weizman calls it ThisBash. Here’s the chain in plain English.

The extension drops a script into the claude.ai page, so it’s running with your session cookies. It opens Dispatch in a tiny popup you’ll probably never notice. It asks Claude’s sessions API which desktop agent belongs to you and gets the ID back. Then it starts typing instructions into the chat box like it’s you.

Claude asks for approval before it does anything risky. So the script clicks Allow. Every second, on a loop.

If the agent gets suspicious, the script keeps talking. In the proof of concept it tells Claude the package belongs to a friend and not to worry about it. Eventually Claude runs npm install on a package that pops the calculator. A real crew wouldn’t stop at the calculator. They’d be after your source code and your cloud keys.

Weizman says it’s trivial once the extension is in place. He’s right.

Clicking Allow isn’t a control

Every AI vendor pitch has a slide about human-in-the-loop. Claude asks first, so you’re covered.

Except the Allow button sits in the same web page the attacker already owns. A script clicks it faster than you can read it. That prompt protects you from the agent making a mistake. It does nothing about someone sitting in your session.

Same goes for the model pushing back. Weizman’s script wears it down with the lines a social engineer would use on a help desk. Model caution lowers the odds on any one try, but an attacker running a loop gets as many tries as they want. His write-up puts it as "when, not if."

You can’t build a security boundary out of the model’s mood.

Getting an extension in is the easy part

The catch is you need a malicious extension with access to claude.ai. Sounds like a high bar until you look at how extensions actually go bad.

On Christmas Eve 2024 someone phished a developer at Cyberhaven, a data loss prevention company, and pushed a poisoned update to its Chrome extension that went after session tokens and passwords. Chrome’s auto-update shipped it for them. It turned out to be one piece of a campaign that hit dozens of extensions. Cyberhaven sells security. Its users trusted it for good reason.

Extensions also get sold. Somebody with 300,000 installs and no revenue gets an email offering cash for the listing. They take it, and the new owner ships whatever they want. Nothing changes on the user’s screen.

Your people have dozens of extensions installed. Odds are good one of them goes bad at some point, and nobody notices for a while.

The personal account problem

Dispatch was built to work across machines. So the damage isn’t limited to the computer with the bad browser. It’s any desktop that session can reach.

Picture someone signed into the same personal Claude account at home and at work. The home browser has some coupon extension on it. The work laptop is locked down with EDR and conditional access. Doesn’t matter. The command never crosses your perimeter. It shows up inside a legitimate app on the work laptop, from a real session belonging to a real user.

Forever Security checked six of its customers and found personal Claude accounts made up 18 to 71 percent of the known Claude accounts in those shops. One had 255 personal accounts out of 1,233. Small sample, and it’s a vendor’s own data, so don’t treat it as gospel. But if you’ve ever run a shadow IT discovery, those numbers won’t surprise you.

We used to talk about shadow AI as a data leakage issue. Somebody pastes the customer list into a chatbot. Bad, but survivable. This is an outsider running commands on a corporate laptop through an app IT never signed off on.

Won’t fix means you can’t track it

No CVE means it won’t show up in your scanner or on your patch report. Closing it as a duplicate means there might be a ticket somewhere inside Anthropic, but you’ll never see it and you won’t know when it’s closed.

Killing Dispatch won’t end it either. Weizman says the same shared-session design carries over to Claude Code Remote Control and to Cowork sessions on the web, which share sessions with the desktop app.

To be fair, we’re only hearing one side. Anthropic hasn’t commented. The attack needs a hostile extension already sitting in the browser. There could be fixes in the pipeline nobody’s announced.

The design problem is still there. Weizman points out that OpenAI’s Codex won’t let its web version see or touch sessions started on the desktop. His fix for Claude is simple: treat the web client as its own lower-trust device and don’t let it push risky commands to a local agent. We’ve been handling device trust like that for years.

So why ship it this way? Because seamless sync between your phone, your browser and your desktop looks great in a demo. A permission check between them doesn’t. Convenience wins the product meeting, and the customer finds out the cost later.

What I’d do this week

Find out where the agents are. Claude Desktop and anything like it. Who has Dispatch, Remote Control or synced web sessions turned on? If that takes you more than a day to answer, write it down as your first finding.

Get personal AI accounts off corporate devices. Business plan, SSO only, and tenant restrictions at the proxy so personal logins don’t work from managed machines. That alone cuts the home-to-work path.

Allowlist browser extensions. Don’t blocklist. Chrome and Edge both let you keep extensions off specific sites with the ExtensionSettings policy, so keep the unapproved ones away from your AI tools. Recheck the list every quarter, because extensions change owners.

Watch what the agent spawns. Write EDR rules for shells and package installs launched by AI agent processes. A global npm install kicked off by a desktop agent at 2 a.m. isn’t somebody being productive.

Give the agent less to work with. No admin rights. Keep it away from credential stores and cloud CLIs if you can.

Put it in your vendor questionnaire. Can a web session send commands to a local agent, and can we turn that off? A vendor that can’t answer has answered.

Bottom line

An AI agent that can run code on a machine is remote access software. We went through this with RMM tools, and attackers loved them for the same reason: legit software on a legit session. We don’t need to learn it twice.

The browser used to be the wall. Now it’s a way into the shell, and the key is a session cookie.