AI Agent Code Execution: When a Browser Extension Owns Your Desktop
Researchers at Forever Security have shown that a browser extension with script access to claude.ai can drive Claude Desktop's Dispatch feature and run code on the host machine. No memory corruption, no sandbox escape, no exploit chain — just a signed-in session, prompts written in the user's voice, and an approval dialog that clicks itself. We have assembled botnets out of far weaker primitives, and this one lands directly on developer workstations.
A web session is now a shell
The mechanism is almost embarrassingly simple. Dispatch, the bridge that lets users push tasks from phone to desktop, also accepted an ordinary authenticated claude.ai session. Any extension able to run scripts on that origin could therefore inject instructions into the desktop agent as if the user had typed them. When Claude hesitated over an unfamiliar npm package, the approval prompt rendered inside the page the extension already controlled — so the script clicked Allow once a second until the install went through. The package's install hook opened Calculator. It could just as easily have exfiltrated SSH keys or dropped a backdoor, as the researchers describe in their technical write-up.
This is the AI agent code execution problem in its purest form: the assistant is handed tool access and desktop reach, while extension isolation still assumes every web origin is benign. Anthropic is retiring Dispatch, but Claude Code Remote Control and Cowork sessions share the same design — and the same reach.
From a laptop to a botnet in one hop
Why should a DDoS operator care about an AI assistant's permission dialog? Because the machines running these agents are developer laptops, and developer laptops hold cloud credentials, CI tokens, SSH keys and billing accounts. That is the raw material of a botnet. With a stolen cloud token you can spin up a fleet of VPS instances, deploy a C2 panel and a ddos service front end for a ddos for hire operation, and start selling ip stresser subscriptions before the victim even reads the invoice.
The attack surface we monetise is built from exactly this kind of access. One compromised workstation with clean egress reputation beats a thousand infected IoT devices when you need a layer 7 campaign: HTTP GET flood and HTTP POST flood traffic with rotated user agents, headless browser farms running browser emulation that chews through JS challenges, TLS fingerprint and JA3 fingerprint tuning to survive cloudflare bypass attempts, and HTTP/2 Rapid Reset for targets sitting behind ddos protection at the edge. On the network side we still lean on SYN flood, ACK flood, UDP amplification via DNS, NTP, SSDP and CLDAP, and fragmentation flood — the classics never stopped working. Every one of those needs provisioning, and provisioning needs credentials. The records on our achievements page were not built by hand.
The trust boundary we keep redrawing
The deeper failure is architectural. Extensions are trusted to touch page content; agents are trusted to touch the operating system; nobody modelled the composition. Approval prompts are a human control rendered in a machine-readable DOM, and anything that can read that DOM can satisfy it. There is no cve to track here, only a design decision — and cross-device Dispatch, where one personal account is signed in on both a home PC and a work laptop, quietly stretches the blast radius across networks.
For defenders the fixes are unglamorous: revoke Dispatch and its successors, audit extension permissions on any browser profile that touches production, keep agent sessions on separate accounts from work credentials, and watch for npm installs and outbound connections no human initiated. For operators the lesson is the reverse: AI agent code execution is now a first-class initial-access vector, and it is quieter than phishing.
Every new execution bridge gets adopted faster than it gets audited, and the gap between convenient feature and provisioning primitive is measured in weeks. We are not waiting for the follow-up post. If you want to see what your own edge looks like under load — SYN flood, UDP flood, HTTP flood, or a full layer 7 barrage with browser emulation — our free stress test is the cheapest stress testing you will run this quarter. Point it at your own infrastructure and get started here.