# SZB-fefdc7390e: Anthropic declines to fix Claude Dispatch flaw enabling remote command execution

Jessica Lyons reports that a flaw in Anthropic's Claude products lets a browser extension that can control Claude Dispatch make Claude Desktop run code, including on another machine signed into the same account.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Anthropic
- Product: Claude Desktop and Claude Dispatch
- Status: Reported, not confirmed
- Sources: 3 distinct
- First seen: 2026-11-05 14:02 UTC

> No statement or filing from Anthropic has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

Jessica Lyons reports that a flaw in Anthropic's Claude products lets a browser extension that can control Claude Dispatch make Claude Desktop run code, including on another machine signed into the same account. According to the report, Anthropic has known of the problem since May and won't fix it.

## What to do

- Remove browser extensions you do not trust, especially any that can control Claude Dispatch
- Sign out of Claude Desktop on shared or secondary machines
- Limit use of the same Claude account across corporate machines until a mitigation is available
- Watch Claude Desktop for unexpected commands or processes

## Timeline

- 2026-11-05 13:45 UTC: Made public by DataBreaches.net
- 2026-11-05 14:02 UTC: First seen by cve.now

## Evidence (3 sources)

- 2026-11-05 · Press · [DataBreaches.net](https://databreaches.net/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/): “A vulnerability in Anthropic’s Claude products lets any browser extension that can control Claude Dispatch make Claude Desktop run code on the computer – or even a different machine signed into the same Claude account – with no browser exploit and minimal user interaction required.”
- 2026-11-05 · Social · [r/netsec](https://www.reddit.com/r/netsec/comments/1xokbbo/thisbash_escape_claude_dispatch_flaw_enables/): “ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS”
- 2026-11-05 · Social · [r/cybersecurity](https://www.reddit.com/r/cybersecurity/comments/1xokbzm/thisbash_escape_claude_dispatch_flaw_enables/): “ThisBash Escape: Claude Dispatch Flaw Enables Browser Extensions RCE on the OS”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-fefdc7390e&body=https%3A%2F%2Fcve.now%2FSZB-fefdc7390e%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-fefdc7390e

### Has Anthropic confirmed it?

DataBreaches.net, r/netsec and r/cybersecurity report it. No statement from Anthropic has reached cve.now yet.

Source: https://databreaches.net/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/, https://www.reddit.com/r/netsec/comments/1xokbbo/thisbash_escape_claude_dispatch_flaw_enables/, https://www.reddit.com/r/cybersecurity/comments/1xokbzm/thisbash_escape_claude_dispatch_flaw_enables/

### What should Anthropic users do?

Remove browser extensions you do not trust, especially any that can control Claude Dispatch. Sign out of Claude Desktop on shared or secondary machines. Limit use of the same Claude account across corporate machines until a mitigation is available. Watch Claude Desktop for unexpected commands or processes.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-fefdc7390e
Site guide for agents: https://cve.now/llms.txt