Claude Dispatch "ThisBash" flaw lets malicious browser extensions drive Claude Desktop to execute commands locally or on other machines on the same account; Anthropic has not fixed it

Key facts for ThisBash Claude Dispatch flaw

Detection coverage for ThisBash Claude Dispatch flaw

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5368 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ThisBash — Claude Desktop/Code Agent Launches Global Package Install (npm add-colors-to-bash)

TL-2026-5368 ThisBash exploitation: a Claude Desktop or Claude Code process (or a shell it spawned) runs a global npm/pnpm/yarn install. In the public PoC a hijacked Dispatch session forced Claude Code to run npm install -g add-colors-to-bash, whose install hook launched Calculator; a real attacker would use the hook for arbitrary code execution. Flags the agent-driven package install itself, with the reported package name highlighted when present.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1059
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| where match(ParentImage,"(?i)claude") OR match(ParentCommandLine,"(?i)(claude|anthropic)")
```ThisBash TL-2026-5368 agent-parented package manager with a global install flag```
| where match(CommandLine,"(?i)\b(npm|pnpm|yarn)\b") AND match(CommandLine,"(?i)\b(install|add|i)\b") AND match(CommandLine,"(?i)(\s-g\b|--global|\sglobal\s)")
| eval ioc_package=if(match(CommandLine,"(?i)add-colors-to-bash"),"add-colors-to-bash","none")
| table _time host User ParentImage ParentCommandLine Image CommandLine ioc_package
| sort 0 - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("npm.cmd", "npm.exe", "pnpm.cmd", "pnpm.exe", "yarn.cmd", "yarn.exe", "node.exe")
| where ProcessCommandLine matches regex @"(?i)\b(npm|pnpm|yarn|npm-cli\.js)\b.*\b(install|add|i)\b"
| where ProcessCommandLine matches regex @"(?i)(\s-g\b|--global|\sglobal\s)"
| where InitiatingProcessFileName contains "claude" or InitiatingProcessParentFileName contains "claude" or InitiatingProcessCommandLine has_any ("claude", "anthropic")
| extend IocPackage = iff(ProcessCommandLine has "add-colors-to-bash", "add-colors-to-bash", "none")
| project Timestamp, DeviceName, AccountName, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, IocPackage
| order by Timestamp desc

Sigma

title: ThisBash - Claude Agent Spawns Global Package Install
id: 7c1e4b52-3a9d-4f6e-8b21-5d0a9c3e1f01
status: experimental
description: Detects a Claude Desktop or Claude Code process lineage running a global npm, pnpm or yarn install, the execution step of the ThisBash Claude Dispatch hijack (TL-2026-5368). The public PoC installed add-colors-to-bash globally to trigger an install hook.
references:
    - https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684
    - https://github.com/Project-Martian/Project-Martian/issues/94
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        - ParentImage|contains: 'claude'
        - ParentCommandLine|contains:
              - 'claude'
              - '@anthropic-ai'
    selection_global_install:
        CommandLine|contains:
            - 'npm install -g'
            - 'npm i -g'
            - 'npm add -g'
            - 'npm install --global'
            - 'pnpm add -g'
            - 'pnpm add --global'
            - 'yarn global add'
    selection_ioc:
        CommandLine|contains: 'add-colors-to-bash'
    condition: selection_parent and (selection_global_install or selection_ioc)
falsepositives:
    - Developers who legitimately ask Claude Code to install global CLI tools
    - Approved developer workstation bootstrap using Claude Code
level: high

Known false positives:

• Developers intentionally asking Claude Code to install global CLI tooling
• Automated onboarding scripts that run under a Claude Code session

Tuning notes: Baseline legitimate Claude Code global installs per developer group and allow-list known package names. Raise priority when the package is unfamiliar, when the session started shortly after a new browser extension appeared, or when ioc_package is add-colors-to-bash. Add bun/pip equivalents if used in your estate. Process lineage depends on how Claude Desktop launches Claude Code on your build; widen ParentImage if intermediate shells are inserted.

• 🔒 ThisBash — Browser Launched With Unpacked/Side-Loaded Extension Flags · unlock with TL Creds
• 🔒 ThisBash — Claude Agent Shell Accessing Developer and Cloud Credential Files · unlock with TL Creds
• 🔒 ThisBash — Same User Reaching Dispatch Session Discovery From Multiple Source Addresses · unlock with TL Creds
• 🔒 ThisBash — Claude Code Started With --dangerously-skip-permissions · unlock with TL Creds
• 🔒 ThisBash — Creation of [indicator] Package Files · unlock with TL Creds
• 🔒 ThisBash — Dispatch Sessions Endpoint and cowork/agent Page Requested via Proxy · unlock with TL Creds
• 🔒 ThisBash — Install-Hook Child Process Following Agent-Driven Package Install · unlock with TL Creds
• 🔒 ThisBash — Automated High-Frequency Requests to Claude Session/Cowork Endpoints (Auto-Approval Cadence) · unlock with TL Creds

Indicators of compromise for ThisBash Claude Dispatch flaw

As of 2026-11-06, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5368.

Sample indicators (1 of 17)

• Domain: claude[.]ai

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

How ThisBash Claude Dispatch flaw works

Anthropic acknowledged the report in May 2026, closed it as a duplicate, issued no CVE or bounty, and has not remediated it.

ThisBash is a design-level weakness in how Claude Dispatch (part of Claude Cowork) exposes desktop-agent sessions to the authenticated claude.ai web interface. Dispatch lets a user send and manage tasks from a phone or browser to Claude Desktop, which runs commands on the user's computer through Claude Code. Because Dispatch sessions are reachable from an ordinary logged-in claude.ai web session, any browser extension holding claude.ai access can act with the user's ambient session cookies and issue instructions that appear to come from the legitimate user. No browser exploit is required. Prerequisites reported: an extension with claude.ai access installed, the user authenticated to the Claude web interface, and the user authenticated to Claude Desktop with Dispatch enabled.

Published reporting describes a six-step chain. (1) A malicious or compromised extension registers a MAIN-world content script on claude.ai, sharing the page's JavaScript context and session cookies. (2) The script opens Dispatch (https://claude.ai/cowork/agent) in a tiny, unfocused popup window, described as the only visible trace of the sequence. (3) Using ambient cookies it calls GET /v1/sessions?tags=cowork-dispatch-local to retrieve the session ID of the Claude Desktop agent. (4) It uses "force prompting", typing instructions into the composer and continuing or rephrasing them if the agent becomes suspicious until it complies. (5) It auto-clicks Claude's permission/approval dialogs at roughly one-second intervals. (6) The cycle repeats until command execution is achieved. The public demonstration (four researcher-written prompts, per the Project-Martian issue summarizing Forever Security's write-up) had Claude Code run a global npm install of the package "add-colors-to-bash" (package name as reported by The Register; its npm registry page could not be retrieved to verify contents or publisher), whose install hook launched the Calculator application, showing local code execution without a browser exploit. The researcher's full code was not disclosed. No independent reproduction is documented and the test date, model version and cleanup status are undisclosed.

The risk crosses machine and corporate boundaries: because Dispatch targets any Claude Desktop agent tied to the same account, an extension in a browser on a personal device could pivot to Claude Desktop on a work laptop when the employee uses one personal Claude account across both. A Forever Security survey of six organizations found personal Claude accounts making up 18% to 71% of known accounts (highest: 20 of 28 accounts, 71%). Demonstration was reported on Claude Desktop for Windows x64; Dispatch was in limited beta for Pro, Max and Ultra plans. Weizman states the same underlying weakness persists in Claude Code Remote Control and Claude Cowork sessions, although reporting says this was not fully demonstrated. Likely attacker objectives noted by reporting are source code and cloud/developer credentials on the host; no admin toggle for the feature is documented.

Vendor response: the report was submitted privately on May 14, 2026 (per the Project-Martian issue) and Anthropic's response is dated May 19, 2026 by the researcher; Anthropic acknowledged it as valid but closed it as a duplicate, paid no bounty, issued no CVE, and told the researcher it planned to retire Dispatch at the end of October 2026. As of The Register's November 5, 2026 report Dispatch remained available to existing users (support page: "If you already use Dispatch, you can keep using it for now") and Anthropic did not answer questions about the retirement timeline. No in-the-wild exploitation, CVE, CVSS score, or network IOCs (IPs/domains of attacker infrastructure) are stated in the sources; severity is analyst-assigned. The researcher suggested treating the web client as a lower-privilege device and blocking dangerous actions from web-initiated Dispatch commands, or following OpenAI's Codex model by preventing web sessions from reaching desktop-initiated sessions.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0051 LLM Prompt Injection; AML.T0053 AI Agent Tool Invocation; T1059 Command and Scripting Interpreter; T1059.007 Command and Scripting Interpreter: JavaScript

Persistence

T1176.001 Software Extensions: Browser Extensions

Collection

T1185 Browser Session Hijacking

Initial Access

T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

lateral-movement

T1550.004 Use Alternate Authentication Material: Web Session Cookie

Lateral Movement

T1550.004 Use Alternate Authentication Material: Web Session Cookie

Defense Evasion

T1564.003 Hide Artifacts: Hidden Window

Remediation for ThisBash Claude Dispatch flaw

Patches

• No vendor patch, CVE or advisory exists as of 2026-11-05; Anthropic reportedly closed the report as a duplicate

Immediate actions

• Inventory browser extensions on every browser used with a Claude account and remove any that do not need claude.ai access
• Disable Claude Dispatch and Cowork remote features on accounts and devices where they are not required (no documented admin toggle; verify settings manually)
• Separate personal and work Claude accounts so a personal browser cannot reach a work-laptop Claude Desktop agent
• Monitor endpoints running Claude Desktop for unexpected npm installs, install-hook execution and unexpected Claude Code sessions

Workarounds

• Do not keep Dispatch, Cowork or Claude Code Remote Control enabled on Claude Desktop when unused
• Rotate cloud and developer credentials that were reachable from a Claude Desktop host if suspicious activity is found

Longer-term hardening

• Restrict web-originated access to desktop agent capabilities (vendor-side change suggested by the researcher: treat the web client as a lower-privilege device or block web sessions from desktop-initiated sessions)
• Treat human approval prompts as a weak control against scripted auto-clicking and enforce allow-listing of agent-executable commands
• Audit which personal Claude accounts are signed in on corporate endpoints

Affected and fixed versions

• Anthropic — Claude Desktop (Windows x64 demonstrated)
  Vulnerable versions: Versions with Claude Dispatch / Cowork remote features enabled; specific build numbers not disclosed
• Anthropic — Claude Dispatch (limited beta; Pro, Max, Ultra plans)
  Vulnerable versions: All current; feature not retired as of 2026-11-05
• Anthropic — Claude Code Remote Control and Claude Cowork sessions
  Vulnerable versions: Reported by researcher to share the same design weakness; not fully demonstrated

Timeline of ThisBash Claude Dispatch flaw

Last updated 2026-11-06 · revalidated 1× · latest source

• 2026-05-14 locked-ioc-14 of locked-ioc-9 privately reports the locked-ioc-10 flaw to locked-ioc-16 (date per the Project-Martian issue summarizing the researcher's disclosure).
• 2026-05-19 locked-ioc-16 responds (date attributed by the researcher), acknowledging the report as valid but closing it as a duplicate of an existing tracked issue; no CVE or bug bounty is issued and Dispatch is slated for retirement at the end of October 2026.
• 2026-10-13 locked-ioc-16 announces locked-ioc-10 will be retired by the end of October 2026.
• 2026-10-30 locked-ioc-16's support page still lists Dispatch as a limited-beta feature available to existing users ("you can keep using it for now").
• 2026-10-31 End of October 2026: locked-ioc-16's stated plan to retire Dispatch passes without Dispatch being retired; the underlying design weakness is reported to persist in locked-ioc-7 and Cowork sessions.
• 2026-11-04 locked-ioc-9 publishes the locked-ioc-17 research, including the demonstration where four prompts and automated approval clicks make the desktop agent install an npm package that launches Calculator (date per the Project-Martian issue).
• 2026-11-05 The Register publishes Weizman's locked-ioc-17 research; locked-ioc-16 declines to answer questions on the retirement timeline. Mirrors (Malware News, SecOpsNews, WindowsForum, Mallory) follow the same day.

Update history

• 2026-11-06 — locked-ioc-17: locked-ioc-10 flaw lets malicious browser extension execute remote commands on locked-ioc-11 (locked-ioc-16 won't fix): What changed No severity, exploitability or status change; remains HIGH / POC_PUBLIC / ACTIVE. Adds technical detail on the PoC and one new timeline event. New indicators (5) Indicator values are withheld at this access level. New MITRE (2)

Sources cited for ThisBash Claude Dispatch flaw

• Mallory: Claude Dispatch Flaw Reportedly Lets Browser Extensions Execute Commands on Linked Computers mallory.ai · Research
• SecOpsNews: [RegisterSec] Anthropic won't fix a Claude Dispatch flaw (issue #76167) GitHub · Code repository · 2026-11-05
• Project-Martian issue #94: ThisBash directs Claude Dispatch to install a Calculator-launching package (cites private report 2026-05-14, vendor response 2026-05-19, public disclosure 2026-11-04) GitHub · Code repository
• WindowsForum: ThisBash - Reported Claude Dispatch Flaw Could Let Browser Extensions Run Code on Desktops windowsforum.com · Blog
• The Register: Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries The Register · News · 2026-11-05
• Malware News mirror: Anthropic won't fix a Claude Dispatch flaw malware.news · News · 2026-11-05
• The Register Forums: Anthropic won't fix a Claude Dispatch flaw The Register · News · 2026-11-05

More in vulnerability

• OpenAI GPT-6 Cyber Identifies 81 Previously Unknown High-Severity Firefox Vulnerabilities (Mozilla MFSA2026-118, Firefox 159)
• Multi-vendor vulnerability roundup: Node2Shell Brotli RCE (CVE-2026-111497, actively exploited, CISA KEV), WatchGuard CVE-2026-98432 (CVSS 9.8) and AuthPoint Gateway flaws, Cisco UCS Central CVE-2026-76506, SonicWall GMS CVE-2026-109593/109594 unpatched (EOL)
• Microsoft Paint Out-of-Bounds Read RCE Vulnerability (CVE-2026-83844)
• Marimo CVE-2026-39987: unauthenticated /terminal/ws RCE exploited to harvest AWS credentials and pivot to an SSH bastion in 8 seconds
• Scans for Cisco IOS XE Web UI Vulnerability (CVE-2023-20198) with RootEvidence Opt-Out Headers

Further reading

• Anthropic AI Misuse Report (Sept 2026) Mapped