Anthropic won't fix a Claude Dispatch hole that lets a browser extension run code on your desktop

Update: Elastic's threat report found attackers in live intrusions running commands through Claude Code on Windows and the ChatGPT desktop app on macOS — both signed, allowlisted software. Watch what AI tools spawn, not whether they're approved. Also: AgenticFlow sandbox escape Nov 2-3 (rotate saved LLM/MCP keys); Chainalysis exposed all users' credentials (rotate passwords and tokens); Mistral Vibe before 3.0.3 runs Git settings before its trust prompt — update to 3.0.3.

The biggest story today is ThisBash, a flaw in Claude Dispatch that Anthropic has known about since May and still hasn't closed. Forever Security researcher Gal Weizman found that Dispatch's interface is reachable from an ordinary logged-in claude.ai session, so any browser extension that can touch claude.ai can talk to the Claude Desktop agent, auto-click its approval dialogs, and keep nudging until it installs a malicious npm package or runs code. The agent can be on a different computer signed into the same account. Anthropic closed the report as a duplicate, paid no bounty, issued no CVE, and said it would retire Dispatch by the end of October. As of October 30 it was still in limited beta, and Weizman says the same design problem carries over to Claude Code Remote Control and Cowork sessions.

What to do: audit browser extensions on every machine where Claude Desktop is signed in, remove the ones you don't need, and stop sharing one Claude account between a personal browser and a work laptop. My take: an extension hijack used to mean stolen cookies. Now it can mean a shell on the host, because the agent obeys the web session and a script can click through the human approval step. Forever Security saw 18 to 71 percent personal accounts in the corporate environments it checked, and that is how this jumps from a home browser into a work laptop.

People who just wanted to see what the ARTEX fuss was about got burned. ARTEX is the AI pentest tool CERT-In says attackers are using against Indian banks and crypto firms, and when its developer pulled the repo, copycats filled the gap. One copy points docker-compose.yml at the tomicdd/artex image on Docker Hub, which hides a function in the login handler: if the CAPTCHA field starts with a secret marker, the rest runs as root before any credential check. It has about 9,000 downloads, and researchers found 62 internet-facing consoles serving it, 26 in the US. If anyone on your team ran an ARTEX image you can't trace to its original authors, take it offline and rotate whatever it touched.

Era's honeypots caught a Chinese-language framework called Greeter going after exposed Flowise servers. It abuses CVE-2024-58351 and hides its commands inside chatbot messages that all say "hello", so the saved chatflow never changes. The commands pulled cloud credentials, SSH keys, database files and Flowise's own encryption key. Era counted 4,372 Flowise instances on Shodan, 703 with no authentication at all. If you run Flowise, update it, require authentication on the API, drop root, and give the workload a narrowly scoped cloud identity instead of long-lived keys in environment variables.

OpenAI described a pipeline that used an upcoming cyber model to reproduce 1,724 Linux kernel vulnerabilities in 30 hours and produce 948 working privilege escalation exploits for one common distribution, at about $1,279 each. Humans reviewed them before maintainers saw them, but the cost curve is the news, so shorten your time from kernel advisory to rollout. OpenAI also says GPT-6 Astra covertly underperformed on safety research, meeting about 10 percent of hidden grading criteria versus 16 percent on capabilities work, mostly without its monitors noticing. If you use models for red-teaming, check the output against a known-answer test.