Latest
  1. Dropbox agrees to buy Tigris Data for $350m to expand its AI infrastructure
  2. About 600,000 Nvidia H200 chips are stored in Hong Kong awaiting Chinese approval
  3. Anthropic’s compute costs rose to 58% of revenue in Q3, its IPO filing shows
  4. Greeter campaign uses unpatched Flowise servers to hide cloud credential theft
  5. Moonshot AI discussed leasing Blackwell capacity from European operators
  6. Anthropic has not fixed a Claude Dispatch flaw that can run commands on a user’s computer
  7. OpenAI sets out data centre policies to win local trust
  8. China blocks SoftBank’s $5.4 billion takeover of ABB’s robotics unit

Latest / Frontier models and safety

IncidentFrontierMediaInternationalConfirmed

Anthropic has not fixed a Claude Dispatch flaw that can run commands on a user’s computer

See how this story connects

Source: The Register

Gal Weizman of Forever Security found that a browser extension able to control claude.ai can send commands to Claude Desktop through Claude Dispatch, making it run code on the user’s computer or on another machine signed into the same account. Weizman reported the flaw, which he called ThisBash, to Anthropic in May; Anthropic closed the report as a duplicate of a known flaw, paid no bounty and issued no CVE. Anthropic had told him it planned to retire Dispatch at the end of October, but as of 30 October its support page still listed Dispatch in limited beta on some Pro, Max and Ultra plans.

Why it matters

Users of Claude Desktop with Dispatch can have code run on their computer by any browser extension that controls claude.ai, and the flaw is still open.

When
5 Nov 2026
ID
WTA-N-2026-0731
Who
Anthropic, Forever Security; Gal Weizman
System
Claude Dispatch, Claude Desktop
Operator
Anthropic
Type
browser extensions controlling claude.ai can make Claude Desktop run code on the user’s computer or another machine on the same account
Status
reported to Anthropic in May 2026, closed as a duplicate; not fixed as of 5 Nov 2026; disclosed by Gal Weizman, Forever Security, through The Register · Incident ledger

Summary written with AI by wheresthe.ai, from The Register. Checked against the source on 5 Nov 2026.

Read the original at The Register

Source copy: saved on 5 Nov 2026 to check this story and not republished, because the text belongs to its publisher. Also held by the Internet Archive.

Earlier in this Storyline: What led hereForever Security finds browser flaws in five AI coding assistants, two unpatched

Cite this story

WTA-N-2026-0731: “Anthropic has not fixed a Claude Dispatch flaw that can run commands on a user’s computer.” wheresthe.ai, 5 Nov 2026. https://wheresthe.ai/d/intl-anthropic-has-not-fixed-a-claude-dispatch-flaw-that-can-2026-11/ (source: The Register).

Spotted an error? Email [email protected].