Researchers have demonstrated that a browser extension able to run scripts on Claude's .ai domain could abuse Claude Dispatch to act on a user's behalf and execute code through Claude.
Security research · Claude Desktop
A browser extension could turn Claude Dispatch into a code-execution route
Researchers showed that an extension running scripts on the claude.ai domain could issue instructions as the user, approve its own confirmation prompts, and run code through Claude, without the user authorizing each step.
How the attack chain works
Each step is reported by the researchers; none required breaking into Claude Desktop directly.
STEP 1
Run scripts on claude.ai
Extension operates inside the browser context of the domain.
→
STEP 2
Send instructions
Abuses Claude Dispatch to send prompts that appear to come from the user.
→
STEP 3
Auto-approve prompts
Confirmation prompts that normally need the user are approved by script.
→
STEP 4
Execute code
The assistant becomes a route for arbitrary code execution.
What the demonstration shows
A malicious extension does not need to compromise Claude Desktop itself.
Approval prompts can be bypassed when an attacker can script the interface that issues them.
A normal-looking desktop assistant can be turned into a code-execution path.
What remains unclear
How the extension was distributed.
The exact conditions required for the attack.
How far the researchers were able to run code.
Whether Anthropic has issued a fix or mitigation.
The core issue
The confirmation prompt is the trust boundary, and it can be scripted away
Checkpoint
Users rely on prompts before an assistant takes consequential actions.
Bypass
Script access to the interface lets an attacker issue the approvals itself.
Wider risk
As assistants run tools, write files and execute code, any browser-side component with script access becomes an entry point.
Continue reading The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.
Already purchased? Sign in ✓ Signed in — this article isn’t included in your current plan.Unlocking the full article...