Sketchy Extension Talks Claude Desktop Into Installing Packages Without Anyone Noticing
Ourtake
Anthropic is retiring Dispatch, but the design behind it is still there. Your AI agent just needed a polite nudge from a browser extension.
What happened
Researchers at Forever Security showed that a browser extension running scripts on claude.ai could send instructions to Claude Desktop through the Dispatch feature, leading the agent to install an npm package that ran code on the computer. The test caused no real-world harm, and Anthropic reportedly plans to retire Dispatch, though the help page does not mention a retirement.