ANTHROPIC WON'T FIX A CLAUDE DISPATCH FLAW THAT COULD LET ATTACKERS EXECUTE REMOTE COMMANDS ACROSS CORPORATE BOUNDARIES

Summary from the TLDR InfoSec newsletter

A browser extension with access to claude.ai can use Claude Dispatch to send prompts to Claude Desktop and achieve remote code execution. The attack exploits shared web and desktop sessions, repeated approval clicks, and a malicious npm package. It can also reach a work computer from a personal browser session. Anthropic knew of the issue in May but has not issued a fix. Dispatch remains available to existing users.