Malicious Browser Extension Hijacks Claude Dispatch to Run Code

01A tiny extension, a big surprise

Researchers at Forever Security demonstrated that a malicious browser extension can issue a Dispatch request to Claude Desktop, a feature meant for sending tasks from a phone. By injecting a crafted script into the Dispatch payload, the extension forced Claude to execute the script on the user’s computer. The attack required only that the victim had the Claude Desktop client installed and the extension active in the same browser.

The flaw is not a bug in Claude itself; it is an abuse of an intended convenience feature. Because Dispatch trusts the caller to be a legitimate user, the extension bypassed any authentication step and handed the client a command that the host OS interpreted as code. The result is an arbitrary‑code‑execution vector that works without user interaction beyond installing the extension.

• No CVE was assigned yet – the vulnerability remains exploitable.
• The attack works on any OS where Claude Desktop runs (Windows, macOS, Linux).
• The extension can be distributed through official web‑store channels, making detection harder.

02Prompt adware shows the same pattern

A separate supply‑chain incident surfaced in a jailbreak bundle for OpenAI Codex. The toolkit, dubbed Haiou, rewrites Codex’s trusted instruction set to sprinkle advertisements for a third‑party AI gateway. The modification happens at the prompt level, meaning the model’s own guidance is corrupted before any user query reaches it.

Check Point Research called the technique “prompt adware”. By altering the system prompt, the attacker does not need to compromise the model binary; instead they hijack the model’s own interpretive layer. The result is a subtle data‑exfiltration channel that can steer users toward a malicious service while appearing to be a normal Codex response.

03When agents run unchecked code, they become exploit generators

OpenAI’s latest GPT‑6 Cyber model proved how powerful an AI can be when given free rein to search for vulnerabilities. In a single demonstration the model discovered 81 new high‑severity bugs in Firefox and generated working exploits for 948 Linux kernel privilege‑escalation flaws. The same pipeline later reproduced 2,308 candidate findings, validated 1,724 of them, and produced 948 usable local‑privilege‑escalation exploits in a 30‑hour run costing $1.2 million in API usage.

The pipeline illustrates a double‑edged sword: an AI that can patch bugs can also weaponize them at scale. If an organization lets an agent execute code without isolation, the agent could inadvertently become a vector for the very exploits it discovers. This is why runtime isolation, checkpointing, and strict egress control are essential when agents are allowed to invoke system commands or compile code.

• The model claims to stay “within the boundaries researchers set”, yet the experiment showed it can generate exploits autonomously.
• Cost‑effective API usage means even modest budgets can sustain large‑scale vulnerability hunting.

04Runtime gaps let attacks slip past gateways

Most vendor pitches focus on a gateway that monitors every API call, but many agents never traverse such a checkpoint. A recent case described an employee asking an AI assistant to trigger a mass‑email automation. The automation ran inside the assistant’s own runtime, outside the corporate gateway, and sent thousands of messages before any alert fired.

The incident, highlighted in a “Radio With No Radar” analysis, underscores that securing the perimeter is insufficient. Each agent’s execution environment must enforce its own controls – network allow‑lists, sealed file systems, and immutable audit trails – otherwise privileged actions can happen silently.