![Claude Dispatch Flaw: 3 Plans, 0 Confirmed Fixes [2026]](https://shattered.io/wp-content/uploads/2026/11/claude-dispatch-flaw-anthropic-wont-fix-register-3-plans-2026-gen.webp)
The Register reported on November 5, 2026 that “Anthropic won’t fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries.” That headline is the core of the story. Dispatch is the feature in Claude Cowork that lets a phone hand work to a desktop, so a flaw in it would touch the machine where a person keeps files, apps and logins.
Here is the catch. The public record is thin. The sources behind this report confirm how Dispatch works, but they do not confirm a vulnerability name, a CVE number, an affected version, a discovery date or a named researcher. They also hold no on-record quote from an identified person explaining why the company would decline a fix. This article separates what is documented from what is only alleged, and it treats the Claude Dispatch flaw as a reported issue, not a proven one.
The timing matters for security teams. AI agents that act on a user’s behalf have already produced real losses, including the LLMjacking cases that left victims with $1M cloud bills. A tool that can run commands on a laptop from a chat message sits in a more sensitive spot than a hosted chatbot. Below, we walk through the confirmed mechanics, the open questions, the market stakes and the steps worth taking this week.
Don't miss new tech stories on Google
Add Shattered once in the Google app and our stories show up in your news suggestions.
What The Register Reported About the Claude Dispatch Flaw #
The Register’s headline makes three claims in one sentence. First, a flaw exists in Dispatch. Second, an attacker could use it to execute remote commands. Third, the reach extends across corporate boundaries, which implies a path from one organization’s context into another’s. The fourth claim sits in the first words: Anthropic will not fix it.
Only the headline and the product facts are verified here. We have no confirmed text from Anthropic stating a position, and the available sources contain no verified quote from any named person on the refusal. That gap shapes how readers should handle the story. “Won’t fix” can mean several things in security practice. A vendor may reject a report as outside its threat model, label the behavior as intended, or defer the work. The headline does not tell us which applies, and we will not guess.
What the headline does establish is a dispute over responsibility. If a vendor treats a risk as a user-side concern while researchers or reporters treat it as a product defect, buyers inherit the decision. Companies then need to decide on their own whether to allow the feature near corporate data. That is the practical meaning of this story, whatever the technical details turn out to be.
How Dispatch Works: One Task, Two Devices #
Anthropic’s documentation for Dispatch describes the product as part of Claude Cowork. A user sends a task from the Claude mobile app. The task then runs on the user’s own computer through the Claude Desktop app. The phone acts as a remote control, and the desktop does the work.
Two conditions apply. The computer must be awake, and the Claude Desktop app must be open. Within those limits, Dispatch can use local files, connectors, plugins and apps on the machine. Anthropic’s materials say it can work inside applications such as Excel, reach internal dashboards and use development tools when instructed.
That list is the reason security teams pay attention. A browser chat window can leak text. A desktop agent with access to a spreadsheet, a dashboard login and a terminal can change things. The difference between those two risk levels is the difference between a data-handling policy and an endpoint-security policy.
The documentation also describes a safeguard. Dispatch forwards permission prompts to the user for actions such as running commands or writing files outside a workspace. In theory, a person holding the phone approves or denies the risky step. Whether any reported attack path avoids that gate is not confirmed, and that is the most important open question in this story.
Confirmed vs Unconfirmed: The Fact Line #
Fast-moving security stories attract details that nobody has verified. The table below sorts the claims that circulate around this report. Confirmed items come from Anthropic’s documentation and the headline itself. Unconfirmed items are the specifics a reader might assume but cannot yet source.
| Claim | Status | Basis |
|---|---|---|
| Dispatch is part of Claude Cowork | Confirmed | Anthropic documentation |
| Tasks go from the Claude mobile app to Claude Desktop | Confirmed | Anthropic documentation |
| Dispatch forwards permission prompts for commands and out-of-workspace writes | Confirmed | Anthropic documentation |
| A Dispatch flaw lets attackers run remote commands across corporate boundaries | Unconfirmed | Headline claim in The Register |
| Anthropic has refused to fix the flaw | Unconfirmed | Headline claim in The Register |
| The flaw bypasses user authorization or permission prompts | Unconfirmed | No source reviewed states this |
| The flaw exposes another company’s files, apps, network or systems | Unconfirmed | No source reviewed states this |
| CVE number, affected version, discovery date, researcher name | Unconfirmed | None published in the sources reviewed |
Two rows deserve extra attention. The bypass question decides how severe the issue is. If an attacker still needs the victim to approve a prompt, the flaw looks like a social-engineering problem. If the attacker can skip the prompt, it looks like a classic remote-execution bug. The sources do not say which, so readers should avoid repeating either version as fact.
Why Cross-Boundary Command Execution Is a Serious Class of Risk #
Security teams build around boundaries. A network perimeter, a tenant, a user account and a device policy each mark a line that outsiders should not cross. A flaw described as crossing “corporate boundaries” suggests an attacker outside a company could influence something inside it. The headline uses that phrase, but the sources reviewed do not explain the mechanism.
The permission prompt question
Permission prompts are only as good as the person reading them. A prompt that says an agent wants to run a command works well when the user started the task and expects it. It works poorly when the user is approving requests from a phone between meetings. Prompt fatigue is a known weakness of every approval-based design, and a mobile screen shrinks the room for detail.
Personal accounts, work machines
Dispatch requires a Pro, Max or Ultra plan. Anthropic’s materials list it as unavailable on Team and Enterprise plans. That detail changes the corporate picture. An employee can run Dispatch on a work laptop under a personal subscription, and the company’s admin console may never see it. We draw that scenario as an inference from the plan rules, not as a finding from the report. It still describes a realistic gap that IT departments know well from earlier waves of unsanctioned software.
The UK’s National Cyber Security Centre has warned that AI-driven malware could hit UK critical infrastructure within two years. Agent tools that run on staff devices widen the surface that kind of threat could use. The NCSC warning concerns a different threat, but the logic is shared: the more authority an agent holds, the more an attacker gains by steering it.
Plan and Platform Limits That Shape the Exposure #
Exposure depends on who can turn the feature on and what it can touch. The confirmed limits give a rough map. They do not prove anything about the flaw, but they narrow the places where a reported issue could matter.
| Dimension | Confirmed detail | Security relevance |
|---|---|---|
| Plan access | Pro, Max or Ultra | Individual subscriptions, often outside admin control |
| Team and Enterprise | Not available | Managed tenants cannot enable it, so exposure runs through personal plans |
| Entry point | Claude mobile app | Task input starts on a phone |
| Execution point | Claude Desktop on the user’s computer | Work runs with local access |
| Availability condition | Computer awake, Desktop app open | Limits the window, but covers a normal workday |
| Reach | Local files, connectors, plugins, apps | Broad data and tool access |
| Linux behavior | Files, connectors and plugins only, no desktop-app control through computer use | Narrower action surface than on other systems |
The Linux row stands out. Anthropic says Linux users get file, connector and plugin access but no computer use for driving desktop applications. That reduces what an agent can click through. It does not remove the connector and file paths, so Linux users should not read it as immunity.
Anthropic’s Position and the Missing On-Record Statement #
The Register’s headline attributes the refusal to Anthropic. The sources reviewed for this article do not include the company’s own wording on the matter. We therefore cannot quote a reason, a severity rating or a timeline. We also cannot say whether the company disputes the premise, accepts the risk or plans a different mitigation.
Readers should resist filling that silence with speculation. Vendors reject reports for many reasons, and some are sound. A report may describe behavior that needs the user to grant access first. It may fall under a documented design choice. It may also be a real flaw that the company has misjudged. Each outcome calls for a different response from customers, and the evidence so far does not separate them.
One fair observation does hold up. Anthropic has publicly invested in vulnerability work. Its research page on discovering vulnerabilities with Claude shows a company that takes security findings seriously in other settings. That context does not settle this dispute, but it makes the “won’t fix” claim more notable. A firm with that profile faces closer scrutiny when it declines to patch its own product.
Industry Data: How Prepared Are Organizations for Agent Risk? #
Whatever the final facts of the Dispatch case, the surrounding data shows that many companies have not caught up with AI security. We pulled five survey figures from 2025 reports. They describe organizations in general, not Anthropic customers specifically.
| Source | Report | Finding |
|---|---|---|
| S&P Global Market Intelligence 451 Research | 2025 Thales Data Threat Report | Nearly 70% of organizations name the fast-moving generative-AI ecosystem as their leading AI-related security concern |
| S&P Global Market Intelligence 451 Research | 2025 Thales Data Threat Report | 73% report investing in AI-specific security tools |
| Proofpoint | 2025 State of AI Security | 70% lack optimized AI-security governance |
| Proofpoint | 2025 State of AI Security | 49% expect shadow-AI incidents within 12 months |
| Accenture | 2025 State of Cybersecurity Resilience | Only 22% have clear policies and training for generative-AI use |
The pattern is easy to read. Money is moving toward AI security, as the 73% figure from S&P Global Market Intelligence 451 Research shows. Governance lags behind, and Proofpoint puts the share without optimized governance at 70%. Accenture’s 22% on policy and training says the human side trails further still. A feature like Dispatch lands in exactly that gap, because it can arrive through a personal subscription before any policy exists.
Proofpoint’s 49% figure on shadow-AI incidents deserves a second look. Nearly half of surveyed organizations expect an incident from unsanctioned AI use in the next year. A phone-to-desktop agent that falls outside Team and Enterprise management fits that description neatly. Again, this is context for the risk, not evidence of the flaw itself.
Historical Context: Tools That Outran Their Controls #
Security history repeats one lesson. A convenient tool spreads faster than the rules around it, then an incident forces the rules to catch up. Browser extensions, remote-access utilities and chat-app plugins all followed that arc. AI agents compress it, because they combine access, automation and natural-language control in one package.
Recent months supply examples close to home. A hijack of a server security plugin that ran as root on roughly 2,950 servers showed how a trusted component becomes an attack path, as we covered in our report on the cPGuard supply-chain attack. In a separate case, attackers used fake coding tests to reach a developer, which our piece on fake coding tests and Binance’s $6.3B loss traced through the defenses developers can use. Neither case involves Dispatch. Both show attackers going after the person and the tooling around the system instead of the system alone.
An agent that takes instructions by chat adds a new target to that pattern. The attacker no longer needs to break the operating system. Persuading the agent, or the person approving its steps, can be enough. That is why the open question about permission prompts matters more than any single bug label.
Competitive Comparison: Where Agent Designs Differ #
We have no verified side-by-side security data on rival products for this story, so we avoid ranking vendors. We can describe the design choices that matter, because they apply to every agent that touches local machines. Developer-focused tools such as those in our Claude Code vs Cursor vs Copilot pricing and limits comparison face the same trade-offs.
Four design questions separate safer agent products from riskier ones. Where does the agent run: in a cloud sandbox or on the user’s own device? Who can start a task: only the local user, or a remote channel such as a phone? What approves a risky action: a prompt, a policy file or nothing? And who controls the setting: the individual or an administrator? Dispatch, by its documentation, runs on the user’s device, accepts tasks from a phone, relies on forwarded prompts and sits on individual plans. Each of those choices has benefits, and each moves some risk onto the user.
Buyers should ask every agent vendor the same four questions. Vendors that answer clearly, with documentation and logs, give security teams something to audit. Vendors that answer with a shrug toward the user push the audit burden back onto the customer. The Dispatch dispute, if the headline holds, is a live test of which camp a vendor falls into.
Market Impact: What Buyers and Investors Weigh #
One reported “won’t fix” decision will not move a market on its own. We have no verified figures on customer losses, contract changes or stock reactions tied to the Dispatch report, and we will not invent any. The effect, if it comes, will show up in procurement checklists first.
Security questionnaires already ask vendors how they handle disclosure and remediation. A public dispute over a refused fix gives buyers a concrete reason to press harder on those answers. Companies that sell to regulated industries, where a reviewer asks for a patch policy, feel the pressure most. They need a written position on agent features before the next audit cycle.
For the wider AI market, the incident reinforces a theme that runs through our security coverage. Enterprise adoption of agents depends on trust, and trust depends on vendors owning their security surface. Rivals will use any visible gap in that ownership as a sales argument, whether or not the underlying flaw proves serious. Anthropic’s own plan structure, which keeps Dispatch off Team and Enterprise, suggests the company sees the feature as a consumer-tier product for now. That limits direct enterprise exposure, but it does not stop employees from bringing the tool to work.
What Security Teams Can Do This Week #
Nothing here relies on unconfirmed technical details. These are general hygiene steps for any desktop agent, and they are our recommendations, not guidance from Anthropic.
- Inventory first. Ask staff whether anyone runs Claude Desktop with Dispatch on a work machine under a personal plan. Because Team and Enterprise plans do not offer Dispatch, the answer will not appear in your admin console.
- Decide a position. Write down whether the feature is allowed, limited or banned on corporate devices. A short written rule beats an unwritten assumption.
- Keep permission prompts on. Tell users never to approve a command or an out-of-workspace file write they did not trigger themselves.
- Cut the access. Remove connectors and plugins that point at sensitive systems from any machine where the feature runs. Dispatch can use local files, connectors and plugins, so each one widens the reach.
- Watch endpoint behavior. Alert on unexpected command execution or file writes originating from the Claude Desktop process.
- Separate devices. Run agent experiments on a machine with no corporate credentials, no internal dashboards and no production access.
Teams that build their own LLM features can borrow the same thinking. Our walkthrough on AI guardrails for LLM apps covers input and output checks that limit what a model can be talked into doing. The principle carries over: constrain the action, not just the prompt.
Five Predictions for the Dispatch Dispute #
These are our own judgments, labeled as such. None comes from a sourced statement.
- Anthropic will publish more detail. Public pressure after a headline like this usually pushes a vendor to explain its reasoning, even if it keeps the same decision.
- Other outlets and researchers will weigh in. The first report rarely stays alone, and independent testing will either support or undercut the cross-boundary claim.
- Documentation will tighten. Expect clearer wording around permission prompts and trust boundaries, because documentation is the cheapest fix a vendor can ship.
- Enterprises will add agent clauses to policy. Security leaders will write rules naming phone-to-desktop agents, since the 22% policy-and-training figure from Accenture shows how many lack one.
- Admin controls will become a selling point. Vendors that offer centralized switches, logs and approval policies will use them against rivals that leave decisions to individual users.
What to Watch Next #
Several signals will clarify the story over the coming days. The first is any on-record statement from Anthropic. A named spokesperson or a documentation update would turn a headline into a position that can be tested.
The second is technical detail. A vulnerability identifier, an affected-version range or a proof of concept would let defenders judge severity. Until then, treat claims about bypassed prompts or access to another company’s systems as unverified. The third signal is independent reproduction. If a second researcher or a security vendor confirms the behavior, the story moves from a single report to an established finding.
Finally, watch whether Anthropic changes how Dispatch relates to Team and Enterprise plans. Any move to bring the feature into managed tenants would raise the stakes for the permission and boundary questions above. We will update this analysis if verified details emerge.
FAQ: Claude Dispatch Flaw #
What is Claude Dispatch?
Dispatch is a feature of Claude Cowork. It lets a user send a task from the Claude mobile app and run it on their own computer through the Claude Desktop app, using local files, connectors, plugins and apps.
Did Anthropic really refuse to fix the Claude Dispatch flaw?
The Register’s headline says so. The sources we reviewed contain no on-record quote from a named person at Anthropic on the matter, so the exact reasoning is unconfirmed.
Can attackers bypass permission prompts?
Unconfirmed. Anthropic’s documentation says Dispatch forwards permission prompts for actions such as running commands or writing files outside a workspace. No source we reviewed says the reported flaw avoids those prompts.
Is there a CVE number for the issue?
None appears in the sources reviewed. The same goes for an affected version, a discovery date and a named researcher.
Which plans include Dispatch?
Dispatch requires a Pro, Max or Ultra plan. It is not available on Team or Enterprise plans.
Does the computer need to stay on for Dispatch to work?
Yes. The computer must be awake and the Claude Desktop app must be open for Dispatch to run tasks.
How does Dispatch behave on Linux?
On Linux, Dispatch can access files, connectors and plugins, but it cannot drive desktop applications through computer use.
Should companies ban Dispatch on work devices?
That is a policy call. Since the flaw is reported and not verified, a reasonable middle path is to inventory use, keep permission prompts on, strip sensitive connectors and run the feature only on devices without corporate credentials until more facts surface.