# Researchers show browser extensions can direct Claude Dispatch to run code

_Published Friday, November 6, 2026 at 8:52 AM EST · Security, AI · Latest · Tier 2 — Notable_

![Researchers show browser extensions can direct Claude Dispatch to run code — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEil2RWGFxPYdzFDr1Tl0G6604dLCacXJDMaR-i0nSdrR7vBGgK-lUkZbE5eZYMbWO0Geqw_rDbN2qUkWpEadukl6gccv-xuUWJfEOx2_FWFiZxjVs4uNPiRK3JYOBo0QI1Lx08xd9Iz3-8TFN_kf-njbCQ-AFDcLNNRy6JcwsZyoM12qLt99OzNQNhmaGs/s1700-nu-rw-lo-l85-e365/claude-dispatch.jpg)

Forever Security researchers demonstrated that a browser extension able to run scripts on claude.ai could use Dispatch to make Claude Desktop execute code. Dispatch accepted an ordinary signed-in website session, allowing the extension to send instructions and click approval buttons on the page it controlled.

The test installed an npm package whose installation script opened Calculator. It required the user to be signed in to both services with Dispatch enabled, the computer awake and Claude Desktop open. Researchers report no real attacks. They say Anthropic planned to retire Dispatch, but existing users can still access it; execution on a different computer was described rather than demonstrated.

## Sources

- [The Hacker News](https://thehackernews.com/2026/11/malicious-browser-extensions-could-use.html)

---
Canonical: https://techandbusiness.org/newswire/agZi7zbbRZKR448szj5PK2
Published: 2026-11-06T13:52:24.062Z
Story chronology: 2026-11-06T12:06:00.000Z
Retrieved: 2026-11-06T22:57:37.757Z
Publisher: Tech & Business (techandbusiness.org)