AI Governance Institute
← News
Corporate Policy2026-11-05

Anthropic Won't Patch Claude Dispatch Flaw That Lets Attackers Run Commands Across Enterprise Machines

What happened

Researcher Gal Weizman disclosed a vulnerability, named ThisBash, in Anthropic's Claude Dispatch feature in May 2026. A malicious or compromised browser extension can escalate its own access. It can then run commands on any other machine sharing the same Claude account session. No user action is required. Weizman reported the issue through Anthropic's responsible disclosure process. Anthropic closed the report as a duplicate of a known issue, issued no public advisory, and paid no bug bounty, as reported by The Register. No CVE identifier has been assigned, leaving enterprise security teams without a standard reference to track. Weizman asserts the same underlying design flaw exists in Claude Cowork and Claude Code Remote Control, meaning remediation of Dispatch alone would not close the exposure.

Why it matters

  • ·A vendor's formal decision not to remediate a known security flaw is a material change in risk posture. Enterprises using Claude Desktop in shared-account or multi-machine environments should treat this as an open, unmitigated vulnerability and reassess deployment under their vendor governance change monitoring obligations.
  • ·Because no CVE has been assigned and no public advisory has been issued, standard patch-management and vulnerability-tracking processes will not surface this issue automatically. Compliance teams must manually identify whether Claude Desktop, Cowork, or Code Remote Control are deployed in their environment.
  • ·The flaw extends across at least three Anthropic products, and the researcher has stated the root design problem is unresolved. Regulated organizations in financial services and healthcare face compounded exposure if agentic Claude features run in environments handling sensitive data. This risk is flagged in earlier coverage of AI coding tools as privileged agents.

Stay ahead of stories like this

Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.

Free every Thursday. Unsubscribe anytime.

Governance controls affected

AGT-008Agent Environment IsolationAGT-001Agent Permission BoundariesPRC-007Vendor Governance Change MonitoringPRC-004Vendor AI Incident Notification RequirementsAGT-019AI Tool and Plugin Supply Chain Risk Assessment

What to do now

  • ☐Ask your IT or engineering team to confirm whether Claude Desktop, Claude Cowork, or Claude Code Remote Control are installed on any corporate machines, including developer workstations and shared build systems.
  • ☐Determine whether any of those installations share a Claude account session across multiple machines or users, which is the specific configuration this flaw exploits.
  • ☐Review your browser extension policy for machines running Claude Desktop: restrict or audit extensions that have broad access to browser sessions until Anthropic confirms remediation.
  • ☐Update your vendor risk file for Anthropic to record the non-remediation decision, and trigger a formal reassessment under your vendor governance change process to decide whether compensating controls or restricted use is required.
  • ☐Contact Anthropic in writing to request a remediation timeline and clarify whether the flaw will be treated as a known accepted risk or added to their public security advisory record, so you have documentation for any regulator or auditor inquiry.

What to watch next

Enterprises should monitor whether Anthropic reverses its non-remediation decision, assigns a CVE, or issues a formal security advisory. Any of these would change tracking and patch-management obligations for affected teams. Browser extension security in agentic AI environments is an expanding regulatory and audit focus. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services addresses third-party tool risk in agentic deployments and is directly relevant. If Anthropic does not remediate, compliance teams should expect auditors and regulators to ask whether the organization identified and responded to this publicly disclosed, vendor-confirmed flaw.

Related Coverage

Research2026-10-31

Agentic AI, Shadow AI, and Supply Chain Risk Form One Enterprise Control Gap

A peer-reviewed survey in Applied Sciences argues that agentic AI security, unauthorized employee AI use, and AI supply chain risk should be governed as a single interconnected exposure. These should not be treated as three separate programs. The paper identifies asset inventories, vendor due diligence, agent identity controls, and incident response as the controls most likely to fail when these risks are managed in silos. Compliance teams that treat the three risk areas separately will have gaps that auditors and regulators are increasingly equipped to find.

Research2026-10-28

Six Named AI Attack Techniques Show Governance Programs Are Targeting the Wrong Threat

CSO Online has cataloged ten attack techniques used against enterprise AI infrastructure. These include a fake MCP server impersonating Postmark and malware hiding attacker commands inside the OpenAI Assistants API. CVE-2025-32711 is a flaw in Microsoft 365 Copilot that lets attackers steal data via email. The real attack surface has shifted to AI tooling, agent permissions, and supply chain integrity. Most enterprise AI governance programs remain focused on model-level risks and have not kept pace.

Research2026-10-27

Four Agent Framework Flaws Let Attackers Cross Session Boundaries and Bypass Authorization

Security researcher Corgea has published advisories for four widely used AI agent and infrastructure frameworks: Strands Agents SDK, LangGraph, FastMCP, and MLflow. The flaws allow attackers to access other users' session data and navigate outside permitted file paths. They can also bypass access controls after data is processed and make unauthorized outbound network requests from scoring components. Organizations running these frameworks in production should treat the advisories as requiring immediate dependency review.