The ThisBash demonstration crossed a browser-to-desktop delegation boundary. A malicious extension able to interact with a logged-in claude.ai session submitted instructions through Dispatch and automatically clicked approval controls. The linked Claude Desktop instance installed a package that opened Calculator. The prerequisite matters: the extension…
Case · DiggingBeagle record
A browser extension used Claude Dispatch to approve desktop execution
The ThisBash demonstration required extension control of an authenticated Claude web session linked to a desktop agent. It reached harmless local execution, including across devices; it was not an unauthenticated webpage exploit.
Public disclosure: Nov 4, 2026
Scope
Vulnerability reported in a controlled research or disclosure setting. Exact prerequisites, versions and absence of documented exploitation must be preserved.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
The cited first-party advisory or research establishes the stated mechanism only within its documented conditions. No unrelated production compromise, extended victim scope, financial harm or universal mitigation is inferred.
Assessed Nov 9, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-THISBASH-DISPATCH-POC · CLM-THISBASH-LIMIT · Forever Security: ThisBash and the Claude Dispatch cross-device task path
At a glance
A browser extension permission to manipulate one website should not silently become endpoint execution authority on another device.
Read the implicationsControlled proof of concept, not evidence of a real criminal intrusion; whether Dispatch was fully retired by November 9 is not independently confirmed.
Limits and uncertaintyFull account
The ThisBash demonstration crossed a browser-to-desktop delegation boundary. A malicious extension able to interact with a logged-in claude.ai session submitted instructions through Dispatch and automatically clicked approval controls. The linked Claude Desktop instance installed a package that opened Calculator.
The prerequisite matters: the extension already controlled the authenticated web interface. It could provide follow-up reassurance in the user's voice and operate the approval surface, rather than merely place hostile text on an arbitrary website. Dispatch could deliver that work to another computer on the same account, extending the consequences beyond the browser's own machine.
An approval click is not always independent consent
The demonstrated sequence used four prompts and automated Allow selections. It did not require a browser exploit, but it did require the extension permissions, authenticated session and paired desktop capability. The report establishes controlled execution, not a criminal intrusion or universal access by every extension.
The researcher reported that Anthropic intended to retire Dispatch. Complete retirement and protection of other connected features were not independently established here. Independent confirmation bound to the destination and exact action is a control to evaluate, not a mitigation whose effectiveness this demonstration measured.
Mechanism and trust boundary
- 01
A malicious browser extension can read and interact with a logged-in claude.ai origin.
- 02
The extension sends instructions through Claude Dispatch and manipulates UI approvals presented in the browser.
- 03
The paired local or remote Claude Desktop instance interprets the accepted instruction as authorization to perform local execution.
Claims & evidence
CLM-THISBASH-LIMITThe initial access prerequisite was a malicious browser extension with page control, not arbitrary webpage content or an unauthenticated network call.supported
Basis: reported finding
- supportsForever Security: ThisBash and the Claude Dispatch cross-device task pathprimary disclosure
Executive summary and Browser-to-OS trust boundary description
CLM-THISBASH-DISPATCH-POCForever Security demonstrated that an extension allowed to operate claude.ai could dispatch instructions and click approvals in a remote Claude Desktop session until a harmless local executable was launched.supported
Basis: reported finding
- supportsForever Security: ThisBash and the Claude Dispatch cross-device task pathprimary disclosure
Executive summary: No browser exploit needed; four prompts and auto-clicked Allow controls
Implications
A browser extension permission to manipulate one website should not silently become endpoint execution authority on another device.
Controls and mitigations
- Treat remote agent command channels as privileged; bind confirmation to independent local user identity, action details and trusted endpoint policy.
Unknowns and contradictions
- Controlled proof of concept, not evidence of a real criminal intrusion; whether Dispatch was fully retired by November 9 is not independently confirmed.
Sources and citation
Material revision history
- Nov 9, 2026 · Published version · first publication · revision 233