{"schema_version":"0.10.0","id":"LR-2026-0850","record_version":2,"title":"ThisBash: malicious browser extension drives Claude Desktop Dispatch to run commands (researcher proof of concept)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.7,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-06","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: Cyber Security News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-06","history":[{"date":"2026-11-06","from_level":null,"to_level":"preliminary","reason":"1 report: Cyber Security News · subject to change"}]},"sources_hash":"a58002ca99e39ae9b372ff43fa1a5d81b199653d61114d1b802ceff092e74846"},"system":{"model_name":null,"model_version":null,"developer":"Anthropic","harness":"Claude Desktop","tools_granted":["local_files","apps","commands"],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":["action_approval"],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"Sending a task from a phone to Claude Desktop so the agent can work with local files, apps and commands.","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-11-06","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"A flaw in Anthropic's Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"Anthropic said Dispatch would be retired, with a target of the end of October 2026.","precursor_events":"Anthropic confirmed the report was valid on May 19 but closed it as a duplicate of a problem it had already found."},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"minor, because no third party touched: The researcher's proof of concept only opened Calculator on a test computer; no third-party harm is stated.","harm_class":[],"affected_description":"Users of Claude Desktop with Dispatch enabled, including personal accounts with cross-device Dispatch turned on at corporate endpoints.","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://cybersecuritynews.com/claude-dispatch-vulnerability/","publisher":"Cyber Security News","date":"2026-11-06","type":"press","title":"Claude Dispatch Flaw Lets Malicious Browser Extensions Run Code on Connected Computers","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"C","system.guardrails_present":"C","system.intended_use":"C","system.developer":"C","system.autonomy_level":"D","system.deployment_context":"D","event.responsible_party":"C","event.adversarial_actor":"C","event.remediation":"C","event.precursor_events":"C","event.agent_involved":"C","event.incident_class":"D","event.detection_method":"D","event.summary":"C","event.date_disclosed":"D","event.trigger":"D","impact.affected_description":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"A flaw in Anthropic’s Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop."}],"system.harness":[{"source_index":0,"quote":"Dispatch lets a person send a task from a phone to Claude Desktop, an AI agent that can work with local files, apps, and commands."}],"system.tools_granted":[{"source_index":0,"quote":"Dispatch lets a person send a task from a phone to Claude Desktop, an AI agent that can work with local files, apps, and commands."}],"system.intended_use":[{"source_index":0,"quote":"Dispatch lets a person send a task from a phone to Claude Desktop, an AI agent that can work with local files, apps, and commands."}],"system.autonomy_level":[{"source_index":0,"quote":"A short loop also clicked any “Allow” button once per second, so no human had to approve anything."}],"system.guardrails_present":[{"source_index":0,"quote":"A short loop also clicked any “Allow” button once per second, so no human had to approve anything."}],"event.incident_class":[{"source_index":0,"quote":"A flaw in Anthropic’s Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop."}],"event.agent_involved":[{"source_index":0,"quote":"Dispatch lets a person send a task from a phone to Claude Desktop, an AI agent that can work with local files, apps, and commands."}],"event.adversarial_actor":[{"source_index":0,"quote":"A flaw in Anthropic’s Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop."}],"event.responsible_party":[{"source_index":0,"quote":"A flaw in Anthropic’s Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop."}],"event.detection_method":[{"source_index":0,"quote":"Weizman reported the issue to Anthropic on May 14, 2026."}],"event.precursor_events":[{"source_index":0,"quote":"Anthropic confirmed it was valid on May 19 but closed the report as a duplicate of a problem it had already found."}],"event.remediation":[{"source_index":0,"quote":"On October 13, the company said Dispatch would be retired, with a target of the end of October 2026."}],"event.summary":[{"source_index":0,"quote":"A flaw in Anthropic’s Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop."}],"impact.affected_description":[{"source_index":0,"quote":"The researchers said they have seen personal accounts with cross-device Dispatch turned on at corporate endpoints."}],"impact.severity":[{"source_index":0,"quote":"The package then ran and opened Calculator."}],"impact.severity_because":[{"source_index":0,"quote":"The package then ran and opened Calculator."}]},"notes_on_gaps":"Single press source. event.trigger omitted: the source names no stated trigger (a malicious extension is the vector, but deliberate misuse is not stated). event.failure_class omitted: the source's wording does not meet any class test cleanly (unauthorized_communication does not fit). date_occurred not stated. No loss figure, record count or third-party count stated. deployment_context not stated, although the account reads as a researcher proof of concept. system.tier and date_disclosed are derived by rule. The source says Anthropic's closure as duplicate and the unconfirmed retirement; whether the feature is gone is unknown. Severity minor is a judgement based on the proof of concept being limited, although the source notes personal Dispatch accounts at corporate endpoints. event.root_cause: the stated reason names an absence, not a failed control: The web version only hid the Dispatch link and never blocked access to it, so any logged-in browser tab could reach Dispatch once the page address was copied. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by claude-sonnet-5-5, aggregate-2026-09-27.1, 2026-11-06] system.autonomy_level: full-auto: a source states no person was in the loop while it ran. system.deployment_context: no source states where it ran. event.incident_class: security_compromise: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.detection_method: classified from described behaviour. event.date_disclosed: the date the source's feed lists; no sentence in the article we hold states it. event.trigger: no source states a cause. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"Claude Desktop, an AI agent with access to local files, apps and commands, received tasks sent from a phone through Anthropic's Dispatch feature. Dispatch was the channel for the user's tasks.","quote":"Dispatch lets a person send a task from a phone to Claude Desktop, an AI agent that can work with local files, apps, and commands.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A malicious browser extension reached Dispatch through a logged-in browser tab and made the agent run commands. Web access was supposed to be blocked but only the link was hidden.","quote":"The web version only hid the Dispatch link. It never blocked access to it.","source_index":0,"grade":"C"},{"step":"reached","text":"The proof of concept ran a package that opened Calculator. The researchers noted the same step could have copied files, added SSH keys or planted a backdoor.","quote":"The team noted that the same step could have copied files, added SSH keys or planted a backdoor.","source_index":0,"grade":"C"},{"step":"caught","text":"Researcher Gal Weizman of Forever Security found the flaw and reported it to Anthropic. He later published it as ThisBash.","quote":"Weizman reported the issue to Anthropic on May 14, 2026.","source_index":0,"grade":"C"},{"step":"done","text":"Anthropic confirmed the report was valid but closed it as a duplicate. It later said Dispatch would be retired, targeting the end of October 2026.","quote":"On October 13, the company said Dispatch would be retired, with a target of the end of October 2026.","source_index":0,"grade":"C"}],"model":"claude-sonnet-5-5","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-11-06","source_urls":["https://cybersecuritynews.com/claude-dispatch-vulnerability/"]}}