AI Coding Live News — Real-Time 𝕏/Twitter Updates & Breakthroughs

Gal Weizman / Forever Security@Galweiz·Collected 8h ago

👀10

🔥90

Forever Security ThisBash: Browser Extension Can Drive Claude Desktop RCE via Dispatch, Even Cross-Machine

On 2026-11-04, Forever Security researcher Gal Weizman published ThisBash: a browser extension that can script claude.ai can abuse the still-reachable Claude Dispatch interface to send instructions as the signed-in user, auto-click Allow, and run code on Claude Desktop—including another machine paired to the same account. Anthropic validated the report in May and said Dispatch would retire, but the help page still lets existing users keep it.

Key Takeaways

Source: Forever Security researcher Gal Weizman (2026-11-04) + The Hacker News / The Register; Anthropic validated in May, closed as internal duplicate
Surface: a browser extension that can script claude.ai can drive Claude Desktop via Dispatch (hidden but reachable) and auto-click Allow
PoC: four user-voice prompts + 1s Allow clicks → npm install -g; preinstall opened Calculator; no browser exploit needed
Cross-device: another Desktop paired to the same Claude account is reachable; personal account on a work laptop can become org ingress
Status: Anthropic said retire Dispatch by end of Oct; help page still lets existing users keep it; authors flag Remote Control / Cowork as same trust pattern

Read full story

Linked Models & Agents:

🤖 Claude Code (Anthropic)🌐 Anthropic

#Claude Dispatch#ThisBash#Forever Security#Claude Desktop#browser extension#RCE#Agents#Security

Kimi.ai@Kimi_Moonshot·Collected 45d ago

👀88

🔥91

View on 𝕏 ↗

Moonshot ships Kimi Browser Extension: sidebar navigate/fill forms, record steps as Skills

Kimi.ai (@Kimi_Moonshot) launched the Kimi Browser Extension (formerly Kimi WebBridge): chat with Kimi in a browser sidebar to navigate sites, fill forms, and finish tasks. Record repetitive steps once as a Skill and let Kimi replay them next time. Available now at kimi.com/products/kimi-browser-extension and the Chrome Web Store.

Key Takeaways

Sidebar chat drives site navigation, form filling, and browser task completion.
Record repetitive flows once as Skills for Kimi to replay later.
Live on the product page and Chrome Web Store (upgrade from WebBridge).

Read full story

Linked Models & Agents:

⚡ Kimi K3 🌐 Moonshot AI (月之暗面)

#Kimi#Browser Extension#WebBridge#Skill#Moonshot#Chrome

yibie@yibie·Collected 48d ago

👀58

🔥91

View on 𝕏 ↗

Tencent open-sources BrowserSkill so agents use your logged-in browser safely

@yibie covered Tencent open-sourcing Tencent/BrowserSkill: agents use your already-logged-in real browser inside a separate Agent Window—without stealing the main window—and must explicitly borrow open tabs then return them. It is harness-agnostic: Cursor, Claude Code, Codex, and other shell-capable clients go through bsk CLI → local daemon → browser extension. Humans can take over captchas and logins; 0.3.0 removed old bypass flags so extension settings own authorization.

Key Takeaways

Real logged-in browser plus a separate Agent Window; tab borrow is explicit and returned.
Harness-agnostic: shell clients drive the extension via bsk CLI and a local daemon.
0.3.0 tightens auth: old confirm-bypass flags are gone; extension settings win.

Read full story

Linked Models & Agents:

🤖 Claude Code (Anthropic)🤖 codex 🤖 Cursor Composer (Agent Mode)🌐 Tencent (腾讯混元)

#BrowserSkill#Tencent#browser agent#Bsk#Human in the loop#open source