Two security firms published research on the two best-known AI desktop apps this week, and the flaws rhyme. Forever Security showed that a browser extension able to run scripts on claude.ai could make Claude Desktop run code on the user's computer, The Hacker News reported(opens in a new tab). The route was Dispatch, a feature that sends tasks from a phone to the desktop app. Dispatch accepted an ordinary signed-in web session, so the extension's script could send instructions that looked like the user's own. The approval prompts appeared in the same web page, and the script clicked Allow every second. In the test, Claude installed a software package whose install script ran on the machine. The flaw was reported in May, and Anthropic said it had already found the issue itself. Anthropic told the researchers it is retiring Dispatch and has closed it to new users, but some existing users can keep it for now, and the researchers said earlier this week that it could still be exploited.
In separate research, Check Point Research described a way around Lockdown Mode, the optional ChatGPT setting OpenAI added in June to limit data theft through prompt injection, meaning hidden instructions planted in content the AI reads. ChatGPT renders HTML previews inside a sandbox, but popups opened from a nested frame escaped it. A crafted prompt, a malicious custom GPT or a shared chat could then pull chat data, with no click needed in the desktop app, per the report(opens in a new tab). OpenAI fixed it on September 18.
The common lesson is where the guardrail lives. These apps can now act on your files and run commands, and their safety controls are drawn by web content. Anything that can run code in that content, whether a browser extension, a shared link or a third party's custom GPT, can reach past them. A browser extension used to be a privacy question. Next to an AI app with computer access, it is a path to running code on the machine.
For companies, the sharper detail is personal accounts. Forever Security says it has seen personal Claude accounts with cross-device Dispatch turned on on work computers at its own customers. That is remote control of a managed laptop, held by an account the company does not manage.
If you use an AI desktop app that can act on your computer, open your browser's extension list today, remove any you do not use that can read all websites, and switch off phone-to-desktop or remote features you have not chosen to rely on. For the CISO, add the AI vendors' web domains to your extension allowlist policy and find personal AI accounts signed in to apps that can run commands on company devices.
Action items
Two security firms published research on the two best-known AI desktop apps this week, and the flaws rhyme. Forever Security showed that a browser extension able to run scripts on claude.ai could make Claude Desktop run code on the user's computer, The Hacker News reported. The route was Dispatch, a feature that sends tasks from a phone to the desktop app. Dispatch accepted an ordinary signed-in web session, so the extension's script could send instructions that looked like the user's own. The approval prompts appeared in the same web page, and the script clicked Allow every second. In the test, Claude installed a software package whose install script ran on the machine. The flaw was reported in May, and Anthropic said it had already found the issue itself. Anthropic told the researchers it is retiring Dispatch and has closed it to new users, but some existing users can keep it for now, and the researchers said earlier this week that it could still be exploited.
In separate research, Check Point Research described a way around Lockdown Mode, the optional ChatGPT setting OpenAI added in June to limit data theft through prompt injection, meaning hidden instructions planted in content the AI reads. ChatGPT renders HTML previews inside a sandbox, but popups opened from a nested frame escaped it. A crafted prompt, a malicious custom GPT or a shared chat could then pull chat data, with no click needed in the desktop app, per the report. OpenAI fixed it on September 18.
The common lesson is where the guardrail lives. These apps can now act on your files and run commands, and their safety controls are drawn by web content. Anything that can run code in that content, whether a browser extension, a shared link or a third party's custom GPT, can reach past them. A browser extension used to be a privacy question. Next to an AI app with computer access, it is a path to running code on the machine.
For companies, the sharper detail is personal accounts. Forever Security says it has seen personal Claude accounts with cross-device Dispatch turned on on work computers at its own customers. That is remote control of a managed laptop, held by an account the company does not manage.
If you use an AI desktop app that can act on your computer, open your browser's extension list today, remove any you do not use that can read all websites, and switch off phone-to-desktop or remote features you have not chosen to rely on. For the CISO, add the AI vendors' web domains to your extension allowlist policy and find personal AI accounts signed in to apps that can run commands on company devices.
Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.
Also worth knowing
- The Hacker NewsMalicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' Computers(opens in a new tab)
Reported to Anthropic in May and still exploitable this week, per the researchers. They say Claude Code Remote Control and Cowork sessions may share the same design and plan a follow-up. If you rely on either, watch for it.
- The Hacker NewsResearchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction(opens in a new tab)
Patched on September 18, but the delivery routes remain the lesson: a crafted prompt, a malicious custom GPT or a shared chat. Treat a chat link from someone you do not know like an email attachment from a stranger.
- The Hacker NewsOpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits(opens in a new tab)
OpenAI rates the model Critical for cybersecurity and is limiting it at first to select customers through the API and Codex. An autonomous pipeline built on it found 948 Linux privilege escalation exploits. Expect patch volume from your vendors to rise, and budget the testing time to apply it.
- The Hacker NewsChainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key Services(opens in a new tab)
New since our November 2 item: Chainalysis now says password hashes and live tokens were exposed for every user. The report also cites Microsoft on AI agents hunting leaked secrets: one went from scanning GitHub to Azure Key Vault data in about five minutes.
- The Motley FoolShopify (SHOP) Q3 2026 Earnings Call Transcript(opens in a new tab)
Shopify says AI-referred orders grew 3.3 times in a year, and 74% of AI-attributed purchases came from outside its top 100 categories. For small sellers in niche categories, a complete product catalog that AI shopping tools can read now matters.