A browser extension could dispatch tasks to a paired Claude desktop

A malicious browser extension with permission to operate on claude.ai used the user authenticated site context to invoke Claude Dispatch task APIs and manipulate approval UI while a desktop assistant remained paired.

Forever Security demonstrates a synthetic remote task culminating in an npm postinstall action that opened Calculator on a paired desktop. The prerequisites include extension permissions and an active connected desktop; this is not a generic extension-free remote exploit.

The browser extension did not need an operating-system exploit. Its initial privilege was permission to read or act on an authenticated claude.ai page. Forever Security reports that this was enough to invoke Dispatch task APIs, observe replies and interact with approval controls in the user's web session. After iterative prompting, its test caused a package postinstall action that opened Calculator through a paired desktop. The cross-device consequence requires a connected desktop and valid account state, not merely visiting a website. Retirement plans for Dispatch were reported, but the study does not establish an independently verified universal fix across Claude's other browser-to-desktop delegation products.

The extension did not need to compromise the operating system directly. Control of an authenticated website session let it submit work through Dispatch, and scripted clicks could approve actions that a paired desktop would execute using its own filesystem and process authority. The demonstrated Calculator launch proves a code-execution path in the research setup, not theft or persistence in a victim organization. Retiring Dispatch removes that particular endpoint; the broader authorization question remains whenever web-controlled tasks can cross into a more privileged desktop agent without independent device-bound consent.