Anthropic leaves Claude Dispatch flaw open, enabling remote code execution
Briefing by News4U · First published
The Register reports that Anthropic has not fixed a Claude Dispatch vulnerability disclosed in May, allowing browser extensions to run code on users' machines or other devices signed into the same account. Researcher Gal Weizman found that Claude Dispatch’s interface and API were reachable from an ordinary logged-in web session at claude.ai. A browser extension able to control claude.ai could send commands to Claude Desktop as if they came from the legitimate Dispatch user. Anthropic acknowledged the report as a valid vulnerability in May, but closed the security issue as a duplicate of a known flaw it was already tracking. [1]