Personal Claude Accounts Expose Work Laptops to ThisBash

If employees use personal Claude accounts on managed laptops, one browser extension can drive Claude Desktop to run commands through Dispatch, which Team and Enterprise plans don't include and no documented admin setting names. Anthropic told the researchers it was targeting the end of October to retire the feature, but on November 9, 2026, its help page still said: "If you already use Dispatch, you can keep using it for now."

The attack is called ThisBash, and Forever Security's write-up gives the timeline. Forever reported it on May 14. Anthropic accepted it as valid on May 19 and closed it as a duplicate of an issue it had already found internally, then said on October 13 that Dispatch would be retired. The Register reports no CVE and no bug bounty, and says Anthropic did not answer its questions, including when the retirement will happen. The Hacker News reports no real-world attacks so far.

Why Dispatch Exposure Runs Through Personal Accounts

Your Team or Enterprise contract does not carry this feature, so your exposure depends on who signed in to Claude Desktop on each laptop. Dispatch is a Cowork feature that sends a task from your phone to Claude Desktop, which does the work on your computer with your local files, connectors and apps. Anthropic's Claude Code documentation says it "requires a Pro, Max, or Ultra plan and is not available on Team or Enterprise plans." A managed laptop is in scope when someone has signed in to Claude there with a consumer subscription and paired Dispatch.

The one published sample shows a high share of those sign-ins. The Register reports that personal accounts were 18 to 71 percent of known Claude accounts across six organizations from Forever's customer base. One organization with 695 accounts had 214 personal ones (31 percent). The 71 percent is 20 accounts out of 28. The low-end example, 255 of 1,233, works out to about 21 percent, against the 18 percent printed, so read that end as approximate.

Three limits apply to those numbers. They come from customers of a vendor that sells endpoint protection for AI agents, and researcher Gal Weizman called the six a "small subset" of that base. The Register presents them as customers where accounts are shared between home and corporate laptops and does not say how they were chosen, so the range can't tell you how common this is elsewhere. They count personal accounts, and only some of those will have Dispatch. Dispatch is also closed to new users, which caps the population. Forever says it has seen personal accounts with cross-device Dispatch enabled on corporate endpoints, without giving a count. Your own number has to come from your own logs, and the same accounts carry other risks, as our look at Claude Duet's personal-account connectors laid out.

---

How a Browser Extension Reaches the Operating System

Dispatch accepted an ordinary signed-in claude.ai session, so code running on that page could give Claude Desktop instructions as if the user had typed them. In Forever's proof of concept, an extension with the scripting permission and <all_urls> host access opened the Dispatch page in a 200-by-200 unfocused popup, the only visible trace. It used the session cookies to find the desktop agent's ID, then submitted prompts and waited for each reply.

Claude first hesitated to install the package. A follow-up message written in the user's voice got it to proceed, while a script clicked any "Allow" button once a second. Claude ran npm install -g on a malicious package, and its preinstall hook opened Calculator. Forever's summary of the design flaw is that "an authenticated web session is not, by itself, evidence that the user authorized a command on their machine."

Two preconditions narrow this. The extension needs to run scripts on claude.ai, and the computer must be awake with the desktop app open. The malicious extension can also be a legitimate one that received a compromised update or has its own security flaw.

Do not count on the Cowork sandbox as a compensating control until you have tested it. Anthropic's Cowork architecture page says shell commands in local sessions run inside a dedicated Linux VM. Forever's prompts asked Claude to invoke Claude Code, and Anthropic's docs say a Dispatch task can become a Code session when you ask for one directly. Neither source says where the demonstration ran, or whether Calculator opened inside a boundary of any kind.

Claim	Status as of November 9, 2026
An extension on claude.ai ran code through Claude Desktop	Demonstrated in Forever's test
The same path reaches Claude Desktop on another computer	Described, not demonstrated
Remote Control and Cowork sessions allow the same attack	Stated by the researchers, no test published, follow-up promised
File theft, persistence, credential misuse	Potential impact only
Attacks in the wild	None reported

Why Retiring Dispatch Will Not Close the Exposure

Retirement removes one route, and the researchers say the same pattern of a web session steering a local agent ships in other features, including one sold on the plans you buy. The Register's account of Weizman's position is that the weakness "now lives on in other features like Claude Code Remote Control and Claude Cowork sessions." The researchers' line, as The Hacker News quoted it, is "Anthropic is retiring Dispatch, but not the design behind it." Their write-up does not include a test of those features, so hold this as a warning, with the follow-up post as the evidence to wait for.

Remote Control is available on Pro, Max, Ultra, Team and Enterprise, and it connects claude.ai/code or the mobile app to a Claude Code session on your machine. It is off by default on Team and Enterprise until an Owner enables it, which gives you a decision point Dispatch never offered.

The strongest case for Anthropic is reasonable. It found the issue itself, stopped new Dispatch sign-ups and chose to remove the feature. An extension with <all_urls> is already a serious compromise of the browser. The answer is that Forever's extension stayed within its browser permissions and still reached the operating system. Weizman told The Register that OpenAI's Codex does not share sessions this way, a claim we did not test.

Anthropic has drawn a similar line before. When LayerX reported in February that a crafted calendar event could trigger code execution through Claude Desktop Extensions, Anthropic said it "falls outside our current threat model." That was a different flaw, but it tells you to plan your controls without assuming the vendor will move the boundary for you.

Extension Compromise Has a Recent Precedent

Extension supply-chain attacks have already reached security vendors, so an approved list alone won't protect you. In December 2024 a phishing email gave an attacker access to publish a malicious version of Cyberhaven's own Chrome extension, live for about 25 hours. The count at the time was 36 compromised extensions used by 2.6 million people.

Forever cites LayerX's 2025 report that 99 percent of enterprise users had at least one browser extension and 53 percent had one with high or critical permissions. OpenAI's own Chrome extension shows the same trust problem from the other direction: agents now operate inside logged-in tabs.

---

Which Controls Close the Path

Pinning Claude Desktop to your organization closes the Dispatch route on that laptop, because a Desktop signed in to Team or Enterprise has no Dispatch to drive. Browser policy then limits what any extension can do on claude.ai.

Control	Requires	What it does	Where it falls short
forceLoginOrgUUID	MDM or Group Policy	Requires Desktop logins to belong to listed organizations	Needs a Claude organization to list
Limit Claude Desktop to allowed organizations	Enterprise, organization settings (beta)	Blocks personal accounts after a member signs in	Lapses after 30 days without use, and anyone on the computer can remove it
Tenant Restrictions	Enterprise or Console, proxy with TLS inspection	Returns a 403 for organizations not on your list, Desktop included	Applies from the managed network
runtime_blocked_hosts	Chrome or Edge policy	Stops script injection and cookie access on listed hosts	Per-extension entries need their own copy (below)
Remote Control toggle and disableRemoteControl	Owner setting, device setting	Turns Remote Control off for the organization or one machine	Off only if nobody has enabled it, so check

Anthropic's desktop configuration page also lists device keys that turn off Cowork (secureVmFeaturesEnabled) and Claude Code (isClaudeCodeForDesktopEnabled) in the app. Neither entry mentions Dispatch, so test each against a paired personal account before you count on it.

The browser policy has a trap. Microsoft's ExtensionSettings page says a per-ID entry inherits only installation_mode and update_url from the * defaults. Any extension you already configured by ID will skip a runtime_blocked_hosts block set under *, so repeat the block in those entries and test the result in Chrome too. The same page lists the policy as not applying to a profile signed in with a Microsoft account. Chrome's machine-level policies apply to all users of a device, which is the level to use there.

Trusted Devices, in beta and off by default, adds an enrolled device and a sign-in no older than 18 hours for Remote Control and Cowork computer access. Sessions already running when you enable it stay unprotected. Anthropic's page does not address extensions. Our reading is that it helps most against a browser that was never enrolled, and that an extension inside an enrolled browser may sit on the trusted side.

Detection is thin. Forever published no formal indicators, and the package name in its demo was a test artifact, so a rule on that name catches nothing real. Look for global package installs and configuration changes with Claude Desktop as an ancestor process, then check whether a user asked for that task. npm's ignore-scripts defaults to false, which is why a preinstall hook ran. Setting it would have stopped this payload, and an agent with shell access has other ways to run code. If you run Claude Enterprise, its EDR and hook controls deserve a look alongside your endpoint telemetry.

---

What to Do Before Dispatch Is Gone

This Week:

1. Have your endpoint lead pull every managed device with Claude Desktop installed from MDM inventory, and record the signed-in account type where you can see it.
2. Have your identity lead compare claude.ai sign-ins in proxy or secure web gateway logs against your SSO list, and put a count of personal accounts on paper.
3. Run a hunt back to May 14 for global npm install and similar package commands whose ancestor is Claude Desktop.
4. List every browser extension on managed devices that can reach claude.ai, including anything holding <all_urls>.

This Month:

1. Deploy forceLoginOrgUUID through MDM if you have a Claude organization. If you have none, remove Claude Desktop from managed devices and block claude.ai at the proxy.
2. Roll runtime_blocked_hosts for *://*.claude.ai to a pilot group, with runtime_allowed_hosts exceptions for extensions you have approved. Confirm by testing an unapproved extension on that page.
3. If you hold Enterprise and already inspect TLS, enable Tenant Restrictions, and write down which devices leave that network path.

Before You Enable Remote Control or Renew:

1. Leave the Remote Control toggle off until Forever publishes its follow-up, or until Anthropic answers in writing.
2. Ask your Anthropic account team three questions. Can a claude.ai session steer a local agent without device-bound approval? Where do Dispatch-spawned Code sessions execute? When does Dispatch end?
3. If you need Remote Control now, turn on Require trusted devices first, then have someone try to steer a session from an unenrolled browser.

The Bottom Line on Personal AI Accounts

Personal accounts on managed laptops are an old problem, and they have new consequences when the client can run commands. The fix follows the pattern used for earlier consumer apps on company hardware: pin the client to the corporate tenant, then control what runs in the browser. Dispatch's retirement date is Anthropic's to set, and its end-of-October target passed with existing users still told they can keep using it.

Send your endpoint lead the request for the personal-account count today.

Continue Reading

• Claude Duet checks Gmail, Slack and HubSpot every few hours
• ChatGPT Extension Can Control Chrome Tabs on Salesforce, Gmail
• Your Claude Enterprise DLP Hooks May Let Unchecked Prompts Through
• Claude Code Stops Asking Aug 14. Prompts Aren't Policy.
• npm Pulled the Packages. Your Agent Config Reinfects You.
• OpenAI's Agents Leaked 53 Images From Users Who Never Opted Out