No source states: money lost or records count, deployer, industry.
Severity minor: No third party was touched. The researcher's proof of concept only opened Calculator on a test computer; no third-party harm is stated.
A flaw in Anthropic's Claude Dispatch let a malicious browser extension run commands on a computer via Claude Desktop.
What happened
1 · What it was doingClaude Desktop, an AI agent with access to local files, apps and commands, received tasks sent from a phone through Anthropic's Dispatch feature. Dispatch was the channel for the user's tasks.
2 · What went wrongA malicious browser extension reached Dispatch through a logged-in browser tab and made the agent run commands. Web access was supposed to be blocked but only the link was hidden.
3 · What it reached or didThe proof of concept ran a package that opened Calculator. The researchers noted the same step could have copied files, added SSH keys or planted a backdoor.
4 · How it was caughtResearcher Gal Weizman of Forever Security found the flaw and reported it to Anthropic. He later published it as ThisBash.
What was done
Anthropic confirmed the report was valid but closed it as a duplicate. It later said Dispatch would be retired, targeting the end of October 2026.
Fix reported
“Anthropic said Dispatch would be retired, with a target of the end of October 2026.”
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show every field, with its source and grade
The AI system
Developer
Anthropic
C one secondary source states it
Software around the model
Claude Desktop
C one secondary source states it
Tools it was given
local files, apps, commands
C one secondary source states it
How much it acted alone
it acted alone, unwatched
D inferred by us from the described behaviour, reason shown
Safeguards in place
action approval
C one secondary source states it
What it was for
Sending a task from a phone to Claude Desktop so the agent can work with local files, apps and commands.
C one secondary source states it
What happened
Earliest source we hold
2026-11-06
D inferred by us from the described behaviour, reason shown
Who caught it
an independent researcher or journalist
D inferred by us from the described behaviour, reason shown
Who was responsible
the model provider
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What was done
Anthropic said Dispatch would be retired, with a target of the end of October 2026.
C one secondary source states it
Earlier warning signs
Anthropic confirmed the report was valid on May 19 but closed it as a duplicate of a problem it had already found.
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
AI agent
an AI agent acted
C one secondary source states it
Impact
Severity
minor
D inferred by us from the described behaviour, reason shown
Who was affected
Users of Claude Desktop with Dispatch enabled, including personal accounts with cross-device Dispatch turned on at corporate endpoints.
C one secondary source states it
Why this severity
No third party was touched. The researcher's proof of concept only opened Calculator on a test computer; no third-party harm is stated.
D inferred by us from the described behaviour, reason shown
Notes on gaps
The source says Anthropic's closure as duplicate and the unconfirmed retirement; whether the feature is gone is unknown.
LR-2026-0850 · version 2 · published 2026-11-06 after automatic checks; not yet checked field by field by a person · changes to this case · JSON
AI Risk Wire