A Browser Extension Could Drive Your Desktop AI Through the Cloud: The 15-Minute Paired-Device Check Before You Keep Remote Control On

What happened. On November 4, security researcher Gal Weizman at Forever Security published a flaw he calls ThisBash in Claude Dispatch, the Anthropic feature that lets you send a task from the Claude website or phone app to Claude Desktop on another computer. Dispatch was reachable from an ordinary logged-in claude.ai session. That meant a browser extension able to act inside that tab could send commands to your desktop as if you typed them. In his proof of concept, the extension had Claude Desktop install a software package whose setup script ran code, and it auto-clicked the approval prompts along the way.

The researcher reported it to Anthropic in May. Anthropic acknowledged it and, by his account, closed it as a duplicate of an issue already known internally. In October the company said Dispatch is being retired. It is now closed to new users, and existing users can keep using it. The researcher says Claude Cowork and Claude Code Remote Control allow the same style of attack and has promised a follow-up. He also reports finding personal Claude accounts with cross-device dispatch switched on inside company computers.

Why this matters to you. Every "run it on my other machine" feature is a bridge. One end is a browser tab, where extensions live. The other end is a computer that can read your files, your bookkeeping export, and your client folders. A coupon extension you installed two years ago, or a good one that shipped a bad update, now sits on that bridge. It does not need your password. It needs your open tab.

The 15-minute paired-device check.

1. List the bridges. Any AI product that lets a browser or phone control a desktop: Claude Dispatch, Claude Code Remote Control, Cowork, ChatGPT desktop pairing, or any toggle labeled remote, cloud to local, or cross-device. Write each one down with the account it runs under.
2. Open each account's devices or sessions page. Remove every paired computer nobody used in the last 30 days. If you cannot name the person who uses a link, turn it off.
3. Find the personal logins. Any team member running a personal AI account on a company computer with a remote link on switches to a work account or disconnects today. The company has no way to see or revoke a personal account's pairings.
4. Count extensions on the receiving machine. The computer that accepts remote commands should carry only extensions you can explain in one sentence. Remove the rest.
5. Keep approvals manual. The attack worked because approval clicks could be automated. Never set an agent to always allow, and never install a tool that clicks approvals for you.

What it is worth. A remote-control link earns its place only when someone sends it real work every week. For most small teams that count is zero. Turn the rest off and the bridge is gone.