# Claude Dispatch "ThisBash" flaw lets malicious browser extensions drive Claude Desktop to execute commands locally or on other machines on the same account; Anthropic has not fixed it

> Researcher Gal Weizman (Forever Security) showed that a browser extension with access to claude.ai can hijack Claude Dispatch, force-prompt the linked Claude Desktop agent, auto-approve its permission dialogs, and obtain command execution on the local machine or on another computer signed into the same Claude account. Anthropic acknowledged the report in May 2026, closed it as a duplicate, issued no CVE or bounty, and has not remediated it.

- **Published:** 2026-11-06T03:52:04Z
- **Last reviewed:** 2026-11-06T04:12:06.034Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5368
- **ID:** TL-2026-5368
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (1 shown free below)

## Description

ThisBash is a design-level weakness in how Claude Dispatch (part of Claude Cowork) exposes desktop-agent sessions to the authenticated claude.ai web interface. Dispatch lets a user send and manage tasks from a phone or browser to Claude Desktop, which runs commands on the user's computer through Claude Code. Because Dispatch sessions are reachable from an ordinary logged-in claude.ai web session, any browser extension holding claude.ai access can act with the user's ambient session cookies and issue instructions that appear to come from the legitimate user. No browser exploit is required. Prerequisites reported: an extension with claude.ai access installed, the user authenticated to the Claude web interface, and the user authenticated to Claude Desktop with Dispatch enabled.

Published reporting describes a six-step chain. (1) A malicious or compromised extension registers a MAIN-world content script on claude.ai, sharing the page's JavaScript context and session cookies. (2) The script opens Dispatch (https://claude.ai/cowork/agent) in a tiny, unfocused popup window, described as the only visible trace of the sequence. (3) Using ambient cookies it calls GET /v1/sessions?tags=cowork-dispatch-local to retrieve the session ID of the Claude Desktop agent. (4) It uses "force prompting", typing instructions into the composer and continuing or rephrasing them if the agent becomes suspicious until it complies. (5) It auto-clicks Claude's permission/approval dialogs at roughly one-second intervals. (6) The cycle repeats until command execution is achieved. The public demonstration (four researcher-written prompts, per the Project-Martian issue summarizing Forever Security's write-up) had Claude Code run a global npm install of the package "add-colors-to-bash" (package name as reported by The Register; its npm registry page could not be retrieved to verify contents or publisher), whose install hook launched the Calculator application, showing local code execution without a browser exploit. The researcher's full code was not disclosed. No independent reproduction is documented and the test date, model version and cleanup status are undisclosed.

The risk crosses machine and corporate boundaries: because Dispatch targets any Claude Desktop agent tied to the same account, an extension in a browser on a personal device could pivot to Claude Desktop on a work laptop when the employee uses one personal Claude account across both. A Forever Security survey of six organizations found personal Claude accounts making up 18% to 71% of known accounts (highest: 20 of 28 accounts, 71%). Demonstration was reported on Claude Desktop for Windows x64; Dispatch was in limited beta for Pro, Max and Ultra plans. Weizman states the same underlying weakness persists in Claude Code Remote Control and Claude Cowork sessions, although reporting says this was not fully demonstrated. Likely attacker objectives noted by reporting are source code and cloud/developer credentials on the host; no admin toggle for the feature is documented.

Vendor response: the report was submitted privately on May 14, 2026 (per the Project-Martian issue) and Anthropic's response is dated May 19, 2026 by the researcher; Anthropic acknowledged it as valid but closed it as a duplicate, paid no bounty, issued no CVE, and told the researcher it planned to retire Dispatch at the end of October 2026. As of The Register's November 5, 2026 report Dispatch remained available to existing users (support page: "If you already use Dispatch, you can keep using it for now") and Anthropic did not answer questions about the retirement timeline. No in-the-wild exploitation, CVE, CVSS score, or network IOCs (IPs/domains of attacker infrastructure) are stated in the sources; severity is analyst-assigned. The researcher suggested treating the web client as a lower-privilege device and blocking dangerous actions from web-initiated Dispatch commands, or following OpenAI's Codex model by preventing web sessions from reaching desktop-initiated sessions.

## MITRE ATT&CK

- T1176.001 Software Extensions: Browser Extensions
- T1185 Browser Session Hijacking
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1550.004 Use Alternate Authentication Material: Web Session Cookie
- T1564.003 Hide Artifacts: Hidden Window
- T1059 Command and Scripting Interpreter
- AML.T0051 LLM Prompt Injection
- AML.T0053 AI Agent Tool Invocation
- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1059.007 Command and Scripting Interpreter: JavaScript

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ThisBash — Claude Desktop/Code Agent Launches Global Package Install (npm add-colors-to-bash)** (`TL-2026-5368-SPL-001`)

TL-2026-5368 ThisBash exploitation: a Claude Desktop or Claude Code process (or a shell it spawned) runs a global npm/pnpm/yarn install. In the public PoC a hijacked Dispatch session forced Claude Code to run npm install -g add-colors-to-bash, whose install hook launched Calculator; a real attacker would use the hook for arbitrary code execution. Flags the agent-driven package install itself, with the reported package name highlighted when present.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1059
- **Data sources:** sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

````spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h
| where match(ParentImage,"(?i)claude") OR match(ParentCommandLine,"(?i)(claude|anthropic)")
```ThisBash TL-2026-5368 agent-parented package manager with a global install flag```
| where match(CommandLine,"(?i)\b(npm|pnpm|yarn)\b") AND match(CommandLine,"(?i)\b(install|add|i)\b") AND match(CommandLine,"(?i)(\s-g\b|--global|\sglobal\s)")
| eval ioc_package=if(match(CommandLine,"(?i)add-colors-to-bash"),"add-colors-to-bash","none")
| table _time host User ParentImage ParentCommandLine Image CommandLine ioc_package
| sort 0 - _time
````

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("npm.cmd", "npm.exe", "pnpm.cmd", "pnpm.exe", "yarn.cmd", "yarn.exe", "node.exe")
| where ProcessCommandLine matches regex @"(?i)\b(npm|pnpm|yarn|npm-cli\.js)\b.*\b(install|add|i)\b"
| where ProcessCommandLine matches regex @"(?i)(\s-g\b|--global|\sglobal\s)"
| where InitiatingProcessFileName contains "claude" or InitiatingProcessParentFileName contains "claude" or InitiatingProcessCommandLine has_any ("claude", "anthropic")
| extend IocPackage = iff(ProcessCommandLine has "add-colors-to-bash", "add-colors-to-bash", "none")
| project Timestamp, DeviceName, AccountName, InitiatingProcessParentFileName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, IocPackage
| order by Timestamp desc
```

### Sigma

```yaml
title: ThisBash - Claude Agent Spawns Global Package Install
id: 7c1e4b52-3a9d-4f6e-8b21-5d0a9c3e1f01
status: experimental
description: Detects a Claude Desktop or Claude Code process lineage running a global npm, pnpm or yarn install, the execution step of the ThisBash Claude Dispatch hijack (TL-2026-5368). The public PoC installed add-colors-to-bash globally to trigger an install hook.
references:
    - https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684
    - https://github.com/Project-Martian/Project-Martian/issues/94
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.execution
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        - ParentImage|contains: 'claude'
        - ParentCommandLine|contains:
              - 'claude'
              - '@anthropic-ai'
    selection_global_install:
        CommandLine|contains:
            - 'npm install -g'
            - 'npm i -g'
            - 'npm add -g'
            - 'npm install --global'
            - 'pnpm add -g'
            - 'pnpm add --global'
            - 'yarn global add'
    selection_ioc:
        CommandLine|contains: 'add-colors-to-bash'
    condition: selection_parent and (selection_global_install or selection_ioc)
falsepositives:
    - Developers who legitimately ask Claude Code to install global CLI tools
    - Approved developer workstation bootstrap using Claude Code
level: high

```

**Known false positives:**

- Developers intentionally asking Claude Code to install global CLI tooling
- Automated onboarding scripts that run under a Claude Code session

**Tuning notes:** Baseline legitimate Claude Code global installs per developer group and allow-list known package names. Raise priority when the package is unfamiliar, when the session started shortly after a new browser extension appeared, or when ioc_package is add-colors-to-bash. Add bun/pip equivalents if used in your estate. Process lineage depends on how Claude Desktop launches Claude Code on your build; widen ParentImage if intermediate shells are inserted.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ThisBash — Browser Launched With Unpacked/Side-Loaded Extension Flags (locked: unlock with TL Creds)
- ThisBash — Claude Agent Shell Accessing Developer and Cloud Credential Files (locked: unlock with TL Creds)
- ThisBash — Same User Reaching Dispatch Session Discovery From Multiple Source Addresses (locked: unlock with TL Creds)
- ThisBash — Claude Code Started With --dangerously-skip-permissions (locked: unlock with TL Creds)
- ThisBash — Creation of [indicator] Package Files (locked: unlock with TL Creds)
- ThisBash — Dispatch Sessions Endpoint and cowork/agent Page Requested via Proxy (locked: unlock with TL Creds)
- ThisBash — Install-Hook Child Process Following Agent-Driven Package Install (locked: unlock with TL Creds)
- ThisBash — Automated High-Frequency Requests to Claude Session/Cowork Endpoints (Auto-Approval Cadence) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 17)

Defanged, TLP:CLEAR.

- Domain: `claude[.]ai`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Register: Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries](https://www.theregister.com/research/2026/11/05/anthropic-wont-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/5307684)
- [Malware News mirror: Anthropic won't fix a Claude Dispatch flaw](https://malware.news/t/anthropic-won-t-fix-a-claude-dispatch-flaw-that-could-let-attackers-execute-remote-commands-across-corporate-boundaries/127043)
- [The Register Forums: Anthropic won't fix a Claude Dispatch flaw](https://forums.theregister.com/forum/all/2026/11/05/202610/)
- [SecOpsNews: RegisterSec Anthropic won't fix a Claude Dispatch flaw (issue #76167)](https://github.com/SecOpsNews/news/issues/76167)
- [WindowsForum: ThisBash - Reported Claude Dispatch Flaw Could Let Browser Extensions Run Code on Desktops](https://windowsforum.com/news/thisbash-reported-claude-dispatch-flaw-could-let-browser-extensions-run-code-on-desktops.451043/)
- [Mallory: Claude Dispatch Flaw Reportedly Lets Browser Extensions Execute Commands on Linked Computers](https://mallory.ai/stories/01a1abd6-3fc6-755f-a195-7b1b92f2bfbb)
- [Project-Martian issue #94: ThisBash directs Claude Dispatch to install a Calculator-launching package (cites private report 2026-05-14, vendor response 2026-05-19, public disclosure 2026-11-04)](https://github.com/Project-Martian/Project-Martian/issues/94)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5368