Secure and Responsible AI

AI assistants on workstations: three weaknesses in one week – Claude Code, Claude Dispatch, and ChatGPT

Between November 5 and 7, 2026, three independent studies were published showing that AI assistants on employee computers are becoming a full-fledged attack surface: from secrets stored in configuration files to commands executed via browser extensions and a protection mode bypass in ChatGPT.

What happened

Claude Code – Secrets in the “Don’t Ask Again” File Apiiro determined that when a user selects the “Yes, and don’t ask again” option, Claude Code saves the approved command literally in a local settings file within the project’s .claude directory – along with any password or token if it was part of the command. Out of 104,185 public copies of this file on GitHub, 1,122 contained at least one secret; totaling 1,379 unique secrets, including 379 database passwords, 43 SSH logins, and 23 AWS keys. Popular scanners (Gitleaks, TruffleHog) failed to detect 215 of these files. Claude Code adds the file to the user’s global git exclusions, but not to the project’s .gitignore file, so the protection does not extend to other collaborators.

Claude Dispatch – Commands from Browser Extensions. Gal Weizman (Forever Security) demonstrated that the Dispatch interface, which relays tasks from a phone or browser to Claude Desktop, is reachable from a logged-in claude.ai session. A malicious or compromised browser extension with access to claude.ai can therefore send commands to be executed on the user’s computer. According to The Register, Anthropic considered the report a duplicate of a known issue and announced plans to deprecate Dispatch; the researcher points out that Cowork and Claude Code Remote Control sessions are similarly exposed.

ChatGPT – Lockdown Mode Bypass. Check Point described a bypass of Lockdown Mode, which is intended to limit data leakage via prompt injection: HTML previews in code blocks allowed a popup window to open outside the sandbox and exfiltrate conversation content. OpenAI patched the vulnerability on September 18, 2026, prior to the study’s publication.

Key findings

  • Claude Code: 1,122 public files with secrets (1.1% of 104,185), 1,379 unique secrets across 63 organizations; including history and saved conversations – 2,539 secrets in 1,994 repositories.
  • Claude Dispatch: Compromise requires a browser extension with access to claude.ai and Dispatch enabled; no CVE or patch, Anthropic announced plans to deprecate the feature.
  • ChatGPT Lockdown Mode: Bypass via popups from HTML previews; patched 09/18/2026, disclosed 11/05/2026.
  • Common Denominator: The assistant’s security is only as strong as its environment – the repository, the browser and its extensions, and local permissions.

Why it matters

SafeWave CommentaryAI assistants operate with user permissions, on their computers, and within their repositories, so they inherit all the weaknesses of that environment and add their own. For security teams, this leads to specific steps: treat agent directories (.claude, .cursor, .gemini) like secrets files – scan them along with git history, add them to .gitignore templates, and rotate everything that has ever been in them; do not include secrets in commands, but instead reference environment variables or a secrets manager; review browser extensions with access to AI assistant domains; and update desktop assistant applications like any other software. It is worth comparing this with the previously described weakness in storing Claude Code tokens on macOS.