Covered by 2 outlets — first reported by The Register Security, Nov 5, 13:00 UTC
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries
MentionsAnthropic
Summary
Researchers at Forever Security say a malicious browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, using Dispatch, a Claude feature that lets people send tasks from their phone to Claude Desktop. The Register reports the code could also run on a different machine signed into the same Claude account, with no browser exploit and minimal user interaction. The Register says Anthropic has known of the problem since May and has taken no action to close it, and The Hacker News reports the flaw can still be exploited.
AI summary by the SecurityTabs newsroom, checked against The Register Security, The Hacker News. Read the outlets below for the full story.
Continue reading
2 outlets, in the order they reported it.
The Register SecurityFirst report
Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries
A vulnerability in Anthropic’s Claude products lets any browser extension that can control Claude Dispatch make Claude Desktop run code on the computer – or even a different machine signed into the same Claude account – with no browser…
The Hacker News
Malicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers
A browser extension that can run scripts on claude.ai could make Claude Desktop run code on a person's computer, researchers at Forever Security, an endpoint security company, showed in a test.
Explained
The technology and terms in this story. Learn more