Anthropic leaves open a Claude flaw that lets add-ons operate code

Security researcher Gal Weizman of Forever Security found a flaw, named ThisBash, in Claude Dispatch. Dispatch is a feature that sends tasks from a phone or browser to Claude Desktop, an AI agent that operates commands on the computer of the user. Anthropic has known of the problem since May and did not fix it.

How it works

The attack needs an extension on the claude.ai website. An attacker can cause a user to install a bad extension, or get control of a good one. The extension opens Dispatch, finds the agent session and types prompts. A script clicks the yes button each second.

The proof

Weizman made a video demo. It installs a bad npm package that opens the calculator app. He tells us that a live attack can steal source code and cloud credentials. Anthropic data shows about 950 million visits each month to claude.ai.

What is not known

Anthropic did not answer questions. It told Weizman that it will retire Dispatch at the end of October. A support page continued to list it on 30 October. Weizman says that the flaw is in the design and is in Cowork sessions too.

Insight: Hijacked add-ons are a proven way to reach agents

Cursor reports that a bad Claude Code update hit a maximum of 5,000 users on 29 October 2026 through an extension store. Weizman says that extension takeovers occur many times. Attackers seem to use add-ons because an agent trusts a user session, and one add-on that they control can give them the agent. Leaders must include extensions as a path to their agents.