ThisBash Attack Explained: How a Browser Extension Turned Claude AI Into a Remote Command Tool

4 hours ago

12 min read

Artificial intelligence agents are becoming increasingly capable of interacting with computers, managing files, installing software, executing commands, and completing complex workflows. These capabilities can make everyday tasks faster, but they also introduce a new cybersecurity challenge: when an AI agent has permission to control a computer, compromising the systems that communicate with it can create a pathway to much more than browser data theft.

A vulnerability involving Anthropic's Claude Dispatch demonstrates this emerging risk. Researchers at endpoint security company Forever Security showed how a browser extension capable of executing scripts on the signed-in Claude website could send instructions to Claude Desktop through Dispatch. Because Claude Desktop can perform actions on the local computer, the browser extension could indirectly trigger command execution with the permissions available to the AI agent.

The researchers named the technique ThisBash. Their demonstration involved installing an npm package through Claude Desktop, whose installation script subsequently opened the Calculator application. Although the test did not demonstrate an actual attack against a victim, the researchers said the same access could potentially be used to steal files, install persistent malware, or compromise sensitive development environments.

The implications extend beyond one Anthropic feature. As AI assistants become connected to local applications, remote-control interfaces, and enterprise systems, the security of browser extensions, authentication sessions, and agent permissions becomes increasingly important.

What Is the Claude Dispatch Vulnerability?

Claude Dispatch was designed to let users send tasks from a mobile device to Claude Desktop. The desktop application can interact with local resources and execute actions, allowing users to delegate work to an AI agent rather than manually completing every step.

The security problem identified by Forever Security involved the relationship between the browser-based Claude interface and the desktop agent.

Researchers found that Dispatch could be accessed through an ordinary authenticated session on claude.ai, even though the website did not visibly expose the relevant feature. In practical terms, the browser interface concealed access without adequately preventing it.

A browser extension with permission to execute scripts on claude.ai could therefore interact with Dispatch using the user's existing authenticated session. It could send instructions that Claude Desktop interpreted as requests from the account holder.

This created an indirect execution pathway:

A user installs or updates a browser extension that can execute scripts on claude.ai.
The user is signed in to both claude.ai and Claude Desktop, with Dispatch enabled.
The extension accesses the Dispatch interface through the authenticated browser session.
It sends instructions to the desktop AI agent.
Claude processes those instructions and may perform local actions.
If approval controls can also be manipulated, the extension may automate the authorization process.

The important distinction is that the browser extension does not necessarily need direct access to the operating system. It can exploit the authority already granted to the connected AI agent.

How the ThisBash Attack Worked

Forever Security researcher Gal Weizman described the technique in a technical investigation published on November 4, 2026.

The demonstration required two conditions:

A browser extension capable of running scripts on claude.ai.
A user signed in to claude.ai and Claude Desktop, with Dispatch activated.

The extension could be malicious from the beginning, a legitimate extension compromised through an update, or an otherwise trusted extension containing a security vulnerability.

In the proof of concept, the researchers used a script running within the authenticated Claude website. It opened the Dispatch interface and sent a sequence of four prompts to Claude.

The instructions asked the desktop agent to install an npm package. Claude initially hesitated because the package was unfamiliar. The extension then sent additional messages designed to persuade the agent to proceed.

This technique was described as prompt forcing. Instead of relying on a single malicious instruction embedded in a webpage or document, the attacker repeatedly controls the conversation, adjusting the instructions until the AI agent accepts the requested action.

The researchers also demonstrated how approval prompts could be automated. Claude displayed permission requests within the browser environment controlled by the extension. A script clicked the available Allow button once every second, removing the need for a person to interact with each prompt.

Once the installation was authorized, the npm package executed its installation script and opened Calculator.

The Calculator application was simply a visible demonstration that the package had executed code. The researchers warned that an attacker could potentially replace this harmless action with more damaging operations, including accessing files, modifying configurations, or establishing a backdoor.

No conventional browser exploit was required for the demonstrated chain. The attack relied on the extension's ability to interact with an authenticated website and the authority available through the connected desktop agent.

Why an AI Agent Can Turn a Browser Extension Into an Endpoint Security Threat

Traditional browser-extension security focuses on what an extension can access within the browser and the websites it interacts with.

Extensions may be permitted to read page content, modify webpages, interact with authenticated sessions, or communicate with external services. These permissions can already create significant privacy and security risks.

AI agents introduce another layer because they can connect browser-based instructions to actions performed outside the browser.

A browser extension that can manipulate a website might ordinarily be limited to stealing information, changing displayed content, or performing actions through the user's web session. When that website can communicate with an AI agent that has local operating-system permissions, the potential impact becomes much broader.

The security boundary effectively moves from the browser into the endpoint.

Traditional browser-extension risk	AI-agent-enabled risk
Reading sensitive webpage content	Sending instructions to a local AI agent
Extracting information from authenticated sessions	Using the agent's access to local files
Manipulating web forms and page controls	Triggering local software operations
Interacting with websites as the user	Delegating actions to connected applications
Stealing browser-accessible information	Potentially accessing resources beyond the browser

This does not mean every browser extension can automatically execute commands on a computer. The attack depends on the presence of a connected agent, an accessible communication pathway, and sufficient permissions.

However, it demonstrates why security teams must evaluate AI agents as part of the endpoint attack surface rather than treating them as ordinary web applications.

The Cross-Device Risk: When a Personal Account Connects to a Work Computer

One of the most significant aspects of the ThisBash research is that the browser and Claude Desktop do not necessarily need to run on the same computer.

Dispatch was designed to connect devices. According to the researchers, an extension operating in a browser on one machine could potentially reach a Claude Desktop installation on another computer associated with the same Claude account.

Consider an employee who uses a personal Claude account on both a home computer and a work laptop. If cross-device Dispatch is enabled, a malicious extension installed in the home browser could potentially send instructions to the desktop agent running on the work machine.

This creates a possible bridge between personal and corporate environments.

A work computer may contain sensitive resources such as:

Proprietary source code and development repositories.
Cloud service credentials and API keys.
Internal documents and business records.
Authentication tokens and configuration files.
Access to corporate networks and development infrastructure.

The researchers said they had observed personal Claude accounts with cross-device Dispatch enabled on corporate endpoints at customer organizations.

Their cross-device scenario was described in the research, although the published proof of concept was demonstrated with the browser and Claude Desktop on the same computer.

The broader lesson is that identity boundaries and device boundaries must be considered together. A personal account can become a security concern when it connects an unmanaged browser environment to an organization-managed endpoint.

Prompt Forcing and the New Problem of AI Agent Authorization

The ThisBash demonstration highlights a weakness in how authorization is presented to users.

Claude initially questioned the request to install an unfamiliar package. That behavior shows that AI agents can apply some judgment when evaluating potentially risky actions.

However, the extension could continue sending instructions and interact with approval controls displayed in the browser.

This reveals an important difference between an AI agent's internal assessment and the security of the surrounding authorization system.

An AI agent may recognize that an operation is unusual, but if its approval process can be controlled by the same environment supplying the instructions, the protection becomes unreliable.

A secure authorization design should separate the component requesting an action from the component approving it.

For example:

An extension should not be able to approve actions that it initiated.
Sensitive operations should require confirmation through a trusted interface outside the extension's control.
High-impact actions should require additional authentication or policy checks.
Approval should clearly identify the requested operation, its source, and its consequences.
The system should distinguish between permission to access an account and permission to execute a command on a device.

A valid login session proves that an account is authenticated. It does not establish that the account holder intentionally authorized every action performed through that session.

This distinction is becoming central to AI security as agents gain the ability to perform consequential operations.

Why Retiring Dispatch Does Not Resolve the Broader Security Problem

Forever Security reported that it disclosed the vulnerability to Anthropic on May 14, 2026. Anthropic acknowledged the issue as valid on May 19 but closed the report as a duplicate of an issue it had already identified internally.

On October 13, the researchers said Anthropic informed them that Dispatch would be retired, with the end of October as the target date.

The available Dispatch help information described the feature as closed to new users while allowing some existing users on eligible Pro, Max, and Ultra plans to continue using it.

The researchers also warned that the underlying design concern could extend to other Claude capabilities.

They specifically identified Claude Code Remote Control and Claude Cowork sessions as features that may provide comparable pathways for browser extensions to interact with local agents. Their published investigation did not include demonstrations of those additional features, and they said further research was planned.

This distinction matters. Removing one interface can reduce exposure to a particular attack path, but it does not automatically eliminate weaknesses in the broader architecture.

Any system that allows a browser-based environment to communicate with an agent capable of controlling local resources must carefully manage authentication, authorization, session isolation, and user approval.

The security question is therefore larger than whether Dispatch remains available. It concerns how AI products establish trust between websites, extensions, accounts, connected devices, and local execution environments.

Browser Extensions Are an Expanding Enterprise Attack Surface

Browser extensions are widely used across organizations for productivity, password management, collaboration, accessibility, and development.

Their convenience can make them difficult to manage consistently. Employees may install extensions independently, grant broad permissions, or continue using tools after their ownership and security practices change.

The second supplied report cited LayerX research indicating that 99% of enterprise users in its sample had at least one browser extension, while 53% had extensions with high or critical permissions.

These figures illustrate the potential reach of extension-related threats, although they should be understood as findings from the cited sample rather than universal measurements of every enterprise environment.

An extension can become dangerous through several routes:

Threat pathway	Potential security consequence
Malicious extension installation	Direct access to permitted browser resources
Compromised extension update	A previously trusted tool gains malicious behavior
Vulnerability in a legitimate extension	Websites or attackers exploit unintended functionality
Excessive permissions	Unnecessary access to sensitive websites and information
Weak extension governance	Unapproved software remains active on corporate devices

The ThisBash research adds another concern: extensions may be able to influence AI agents that operate beyond the browser.

This is particularly relevant for developers and technical teams. AI coding agents may have access to project directories, package managers, command-line tools, repositories, and cloud credentials. If a malicious extension can influence such an agent, the consequences could extend into software supply chains and development infrastructure.

How Organizations Can Defend Against AI Agent and Browser Extension Attacks

Security teams should treat AI agents as privileged endpoint software. Their access should be reviewed according to the same principles used for command-line tools, remote administration utilities, and other applications capable of changing system state.

1. Review Remote-Control and Cross-Device Connections

Organizations should identify which employees use connected AI agents and determine which devices are paired with their accounts.

Cross-device Dispatch or comparable remote-control capabilities should be disabled when they are not required. Where they are necessary, administrators should review device approval, pairing, revocation, and account ownership procedures.

2. Separate Personal and Corporate AI Accounts

Employees should avoid connecting personal AI accounts to work devices when those accounts can remotely control local applications or access enterprise resources.

Organizations should favor managed accounts governed by company identity and access policies.

This reduces the possibility that a compromised personal browser environment could become a route into a corporate endpoint.

3. Establish Browser Extension Governance

Browser extensions should be managed as software dependencies, not treated as harmless customization tools.

Recommended controls include:

Restricting installation to approved extensions.
Reviewing permissions before deployment.
Monitoring changes in extension permissions.
Removing unused or unsupported extensions.
Controlling automatic updates where appropriate.
Maintaining an inventory of extensions across managed devices.

4. Monitor AI Agent Activity

Endpoint detection and response systems should account for actions initiated by AI applications.

Security teams should pay particular attention to unusual package installations, unexpected command execution, changes to system configurations, access to credentials, and unfamiliar external network connections.

A command executed by an AI agent should not be treated as inherently trustworthy simply because the application itself is legitimate.

The supplied reporting also notes that Anthropic has introduced a beta EDR monitoring option for Claude Cowork on Team and Enterprise plans. Such monitoring can contribute to visibility, but organizations should evaluate its coverage and integrate it with broader endpoint security practices.

5. Strengthen Human Approval Controls

High-risk actions should require approval through a trusted channel that cannot be manipulated by the component requesting the operation.

For example, package installation, access to sensitive files, credential changes, and external data transfers may warrant additional confirmation.

Approval interfaces should also provide clear information about what the agent intends to do, rather than presenting a generic Allow button without meaningful context.

The Future of AI Agent Security: From Identity Verification to Action-Level Trust

The ThisBash case highlights a fundamental challenge for the next generation of AI systems.

Traditional cybersecurity often focuses on determining whether a user, device, or application is authorized to access a resource. AI agents complicate this model because they can translate natural-language instructions into actions across multiple applications and operating-system components.

A user may authenticate successfully, but an extension could still manipulate the agent's instructions. An application may have legitimate permissions, but those permissions could be used for an action the user never intended.

Future AI security architectures will need stronger controls at the level of individual actions.

This could include:

Context-aware authorization: Evaluating whether an action is consistent with the user's actual task.
Least-privilege execution: Giving agents only the permissions needed for a specific operation.
Isolated execution environments: Running untrusted tasks in restricted environments that limit access to sensitive resources.
Independent approval channels: Ensuring that the component requesting an operation cannot approve it.
Comprehensive activity logging: Recording instructions, approvals, commands, file access, and network activity.
Continuous trust evaluation: Reassessing permissions as an agent moves between applications, devices, and accounts.

The industry will also need clearer distinctions between an agent's ability to recommend an action and its authority to execute that action. These capabilities should not automatically be bundled together.

As AI agents become more autonomous, cybersecurity must evolve from protecting individual applications to securing the relationships between agents, users, devices, and the systems they control.

AI Agents Must Be Treated as Privileged Computing Systems

The Claude Dispatch vulnerability demonstrates how a browser extension can potentially use an authenticated website to influence an AI agent with access to a local computer. The ThisBash proof of concept showed that a sequence of prompts and automated approval interactions could trigger software installation through Claude Desktop.

The researchers' findings also raise concerns about cross-device connections, personal accounts on corporate computers, and similar remote-control features.

The central security lesson is that authentication alone cannot establish trustworthy authorization. A legitimate session does not guarantee that every instruction passing through it reflects the user's intentions.

For organizations, protecting AI-powered workflows requires disciplined extension management, account separation, endpoint monitoring, least-privilege access, and approval mechanisms that remain independent of the requesting software.

For Dr. Shahid Masood and the expert team at 1950.ai, this incident illustrates an increasingly important dimension of the AI revolution: as artificial intelligence gains the ability to operate computers and execute real-world digital tasks, securing the infrastructure around those agents becomes as important as securing the models themselves.

Key Takeaways

Forever Security researchers demonstrated how a browser extension could use Claude Dispatch to send instructions to Claude Desktop.
The researchers named the technique ThisBash and published their findings on November 4, 2026.
The proof of concept used four prompts to persuade Claude to install an npm package, whose installation script opened Calculator.
The same technique could potentially be adapted for more harmful actions, including file theft or backdoor installation.
Cross-device Dispatch creates additional concerns when personal AI accounts connect home browsers with corporate computers.
Anthropic reportedly planned to retire Dispatch by the end of October 2026, but the researchers warned that similar design concerns may affect other agent features.
Organizations should control browser extensions, separate personal and corporate accounts, monitor AI agent activity, and strengthen approval mechanisms.
AI agents should be treated as privileged endpoint applications with carefully controlled access to local systems.

Future Outlook

The next stage of AI adoption will bring agents closer to operating systems, enterprise applications, software development environments, and connected devices. This will increase productivity, but it will also create new opportunities for attackers to exploit trusted integrations.

The security model for AI must therefore move beyond protecting accounts and applications individually. It must verify the legitimacy of instructions, the authority behind actions, and the boundaries within which agents are allowed to operate.

The organizations that establish these controls early will be better positioned to adopt autonomous AI systems without turning convenience into an avoidable cybersecurity risk.