Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-fefdc7390eEarly warningVulnerabilityReported, not confirmed

Anthropic declines to fix Claude Dispatch flaw enabling remote command execution

Jessica Lyons reports that a flaw in Anthropic's Claude products lets a browser extension that can control Claude Dispatch make Claude Desktop run code, including on another machine signed into the same account.

Written by a model from the sources below. Verify against them.

Sources3Reported, not confirmed
Kind
Vulnerability
Vendor
Anthropic
Product
Claude Desktop and Claude Dispatch
Status
Reported, not confirmed
First seen

Summary

Jessica Lyons reports that a flaw in Anthropic's Claude products lets a browser extension that can control Claude Dispatch make Claude Desktop run code, including on another machine signed into the same account. According to the report, Anthropic has known of the problem since May and won't fix it.

What to do

  • Remove browser extensions you do not trust, especially any that can control Claude Dispatch

  • Sign out of Claude Desktop on shared or secondary machines

  • Limit use of the same Claude account across corporate machines until a mitigation is available

  • Watch Claude Desktop for unexpected commands or processes

Timeline

  1. Made public by DataBreaches.net
  2. First seen by cve.now

Evidence 3

  1. Press
    DataBreaches.net
    “A vulnerability in Anthropic’s Claude products lets any browser extension that can control Claude Dispatch make Claude Desktop run code on the computer – or even a different machine signed into the same Claude account – with no browser exploit and minimal user interaction required.”
  2. Social
    r/netsec
    “ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS”
  3. Social
    r/cybersecurity
    “ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about SZB-fefdc7390e

Has Anthropic confirmed it?

DataBreaches.net, r/netsec and r/cybersecurity report it. No statement from Anthropic has reached cve.now yet.Source: DataBreaches.net, r/netsec, r/cybersecurity

What should Anthropic users do?

Remove browser extensions you do not trust, especially any that can control Claude Dispatch. Sign out of Claude Desktop on shared or secondary machines. Limit use of the same Claude account across corporate machines until a mitigation is available. Watch Claude Desktop for unexpected commands or processes.

Sources