cyber.hendryadrian.com
Threat Research · thehackernews.com

Researchers Show Malicious Browser Extensions Can Use Claude Dispatch to Run Code

· Original article ↗

Summary

Forever Security researchers demonstrated that a script-running browser extension on claude[.]ai could use an authenticated Claude Dispatch session to prompt Claude Desktop to install an npm package; they report no real-world attacks.

Key points

  • The demonstrated attack required an extension able to run scripts on claude[.]ai, signed-in browser and Claude Desktop sessions, and Dispatch enabled; the computer had to be awake with the desktop app open.
  • In the test, a script sent Claude prompts through Dispatch, then clicked approval buttons displayed in the page the extension controlled.
  • Claude installed an npm package whose install script opened Calculator. Researchers said the same access could be used to steal files or install a backdoor, but did not demonstrate those actions.
  • The test used a browser and Claude Desktop on the same computer. Researchers described, but did not demonstrate, reaching Claude Desktop on another computer signed in to the same account; they reported no real-world attacks.
  • Researchers said Anthropic accepted their report as valid, then closed it as a duplicate of an issue it had found internally.
  • Researchers said Anthropic planned to retire Dispatch by the end of October, but the help page said existing users on some plans could continue using it for now.
  • Researchers said Claude Code Remote Control and Claude Cowork sessions could permit similar abuse, but their write-up did not test those features.

Article Details

Attack Vectors
  • A browser extension with the ability to run scripts on claude.ai can use an ordinary signed-in session to send instructions through Dispatch to Claude Desktop, provided the user is signed in to both and Dispatch is enabled.
  • In the researchers’ test, a page script sent prompts that led Claude to install an npm package. The script automatically clicked approval buttons displayed in the page controlled by the extension; the package’s install script then opened Calculator.
  • The researchers say the same path could be used to steal files or install a backdoor, but report no real attacks. Their test used the browser and Claude Desktop on the same computer; reaching a different computer through the same Claude account is described but not demonstrated.
Defensive Notes
  • The Dispatch help page advises users to know how to quickly disconnect or revoke access before enabling the feature, but the article says the page does not explain how.
  • Dispatch works only while the computer is awake and Claude Desktop is open. Anthropic reportedly told the researchers it planned to retire Dispatch by the end of October; the help page still said existing users could continue using it for now.

MITRE ATT&CK

T1176 · Software ExtensionsThe reported attack path depends on a browser extension running scripts on claude.ai; the researchers say the extension could be malicious, compromised by an update, or vulnerable.

People

Gal WeizmanForever Security researcher who authored the technical write-up describing the Dispatch attack path.

Vendors

AnthropicThe researchers say Anthropic, the company that makes Claude, told them on October 13 that Dispatch would be retired, with the end of October as the target. The Dispatch help page, last updated late last week, does not

Products

Claude Code Remote Controlbut not the design behind it," the researchers wrote, adding that two other Claude features, Claude Code Remote Control and Claude Cowork sessions, let extensions carry out the same attack. Their write-up does notClaude Coworkit," the researchers wrote, adding that two other Claude features, Claude Code Remote Control and Claude Cowork sessions, let extensions carry out the same attack. Their write-up does not include a test of thoseClaude DesktopA browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.DispatchThe attack needs Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The flaw that makes this possible can still be exploited, the researchers said earlier this week.

Related Articles