It is the name Forever Security's researchers give to a technique they describe in a post dated November 4, 2026. They report that a browser extension able to run on claude.ai could use Claude Dispatch to send Claude Desktop instructions as if the user had sent them, and that in their demonstration the result was the Calculator app opening. According to The Hacker News, the test ran with the browser and Claude Desktop on the same computer, and the researchers report no real-world use.

Has Anthropic said anything about the ThisBash report?

We could not confirm either way. The researchers say Anthropic told them on October 13 that Dispatch would be retired, targeting the end of October, and that the weakness remained exploitable as of their November 4 post. The Register's headline says Anthropic will not fix it, and its text says Anthropic did not answer its questions. Anthropic's help page, read November 6, says Dispatch is in limited beta and not available to new users.

What do Kiro bots do, and what do they cost?

Per a kiro.dev post dated November 5, 2026, a bot is a named, long-running agent, generally available in Kiro Crew, with its own memory, a work log, scheduled runs and its own tool permissions, including an approval step for added tools. The launch post lists no price; the pricing page lists plans, not per-bot costs. Kiro's Crew page says the Crew app is free, open-source software (Apache License 2.0) that needs a Kiro plan to run, and Kiro's pricing page, read November 6, lists plans: a Free plan with 50 credits a month and Pro at $20 a month with 1,000 credits, with add-on credits at $0.04 each. The Crew page also mentions a signed audit log, which we did not test. One setting, Dynamic capabilities, is labelled Preview in a screenshot description on the page.

Can Microsoft Clarity show which AI agents visit my site?

Microsoft's November 4, 2026 post says an Agent Activity dashboard shows which agents visit and what they do, such as searches, logins and checkout, and that supported agents at this time "include" Google, OpenAI and Anthropic agent operators. Microsoft's companion post cautions that agent sessions may include a human handoff. The pages we read do not describe how providers are detected; the October 29 post says only that sessions were classified using "detected agentic browser providers".

What hardware does Foundry Local need to run Qwen3.8-27B for Copilot?

Microsoft's post printed November 5th, 2026 asks for an NVIDIA GPU with at least 24 GB of VRAM for the 4-bit build of about 18 GB, with context up to 64K tokens, and 32 GB or more for up to 262K. It requires Foundry Local CLI 0.13.0 or later, whose release page is marked Pre-release, and CUDA and cuDNN runtimes installed separately. Mac and AMD support is planned with no timeline.

Signal / Noise Nov 6: ThisBash, Kiro, Clarity

A glass prism on a metal base splits five white light beams from a wall panel: two red beams reach a red button and a lever on a raised platform, and three white beams light glass display cubes holding a crystal cluster, a faceted gem and a sphere

The short version

Researchers report that a browser extension with access to claude.ai could drive Claude Desktop through Dispatch to run a command: check the extensions on computers that run Claude Desktop. Kiro makes bots, named agents with their own memory and permissions, generally available. Microsoft Clarity's agent dashboard, Sierra's Anon deal and Foundry Local's Qwen3.8-27B are Watch items.

In plain words

Three terms in this digest. Dispatch is a Claude feature for sending tasks from a phone to Claude Desktop, an app whose agent can run commands on the computer. Auto-approve (or 'always allow') means an agent's action runs without asking you each time. BYOK (bring your own key) means you connect your own model endpoint to a tool such as GitHub Copilot.

If you or your developers use Claude Desktop, start with the first Signal item: researchers report that a browser extension could have steered it into running a command, and the checks are on your own computers. If you run coding agents that work on a schedule, read the second. This digest covers public sources dated November 4 to November 6, 2026, which we read on November 6, 2026. Where an item has a companion page (a help page, a release page or a model card), we read that too. Nothing here was tested by us, and each number belongs to whoever published it.

How we label items: Signal means an actionable development, and Watch means a credible change that is not yet usable or not yet validated. ThisBash and Kiro bots are Signal; Microsoft Clarity, Sierra and Anon, and Foundry Local with Qwen3.8-27B are Watch.

Signal: Researchers report that a browser extension could drive Claude Desktop through Dispatch to run a command

Forever Security, an endpoint security company, published a post dated November 4, 2026. It reports on Claude Dispatch, a Claude feature for sending tasks from a phone to Claude Desktop (Forever Security says the same interface was also reachable from a claude.ai browser session). So, the post says, a browser extension able to control claude.ai could send Claude Desktop instructions as if they came from the user. The researchers call this ThisBash. Claude Desktop is, in the post's words, an AI agent that runs commands on the computer.

What the post says it showed: four prompts sent by a script, plus a script that clicked any "Allow" button every second. The post states that Claude "initially hesitated" to install an unfamiliar package, that a follow-up message written in the user's voice was followed by the install, and that the package's install script opened the Calculator app. That is the only action demonstrated. The post says the same step "could do anything", which is the researchers' statement, not something they showed. According to The Hacker News, the test ran with the browser and Claude Desktop on the same computer, and the researchers report no real-world use; the reach to another computer signed in to the same account is described but not shown.

The precondition, per the post and both news reports: an extension with permission to run on claude.ai (one the user installed, or a legitimate one later compromised), and a person signed in to both claude.ai and Claude Desktop with Dispatch turned on.

Status as of November 6, 2026, and it may change. Who says what, with dates:

Forever Security, November 4: reported to Anthropic on May 14; on May 19 Anthropic acknowledged the findings but, in the researchers' account, "closed the report as a duplicate of an issue they had already found internally"; on October 13 Anthropic stated that Dispatch would be retired, targeting the end of October 2026. The researchers say the weakness remained exploitable as of that post.
The Register, November 5: its headline says Anthropic "won't fix" the issue, and its text says Anthropic did not respond to its questions, including when it planned to retire the feature; its text also relays the researcher's account that Anthropic acknowledged the report and planned to retire Dispatch. All of this is The Register's reporting.
The Hacker News, November 6: reports that the Dispatch help page does not mention a retirement and says Dispatch is closed to new users.
Anthropic's help page, which we read on November 6: "Dispatch is in limited beta on some Pro, Max, and Ultra plans, and it isn't available to new users." Existing users "can keep using it for now". As read on November 6, the help page gives no retirement date; The Hacker News says it was last updated late last week.

We did not find an Anthropic statement about the researchers' report, so whether the technique still works today is not confirmed by us. The researchers also say Claude Code Remote Control and Claude Cowork sessions allow the same technique; The Hacker News notes the write-up does not test them, and a follow-up post is promised. Forever Security is an endpoint security vendor; we note this for context and have not verified its claims.

Verdict: Signal, because the conditions the researchers describe are things you can check on your own computers today. For operators: (1) List and remove browser extensions you do not recognise, on every device signed in to the Claude account. (2) If your Claude Desktop offers an 'always allow' or auto-approve option for tool actions, review it (our suggestion; neither the researchers nor Anthropic's help page describes such a setting). The researchers report their script pressed every Allow prompt, so do not count on it; per The Hacker News, the approval prompts appeared in the web page the extension controlled. The researchers' own advice is to protect approval mechanisms from automation and to turn off cross-device Dispatch where there is no business need. This is our reading, not Anthropic's guidance. For what such desktop agents can reach, see our piece on desktop agent permissions (it covers other products) and our report on a desktop app installing agent plugins.

Signal: Kiro says bots are now generally available in Kiro Crew: named agents that run on a schedule, with their own memory and tool permissions

Kiro says it is built and operated by a team within AWS (kiro.dev/about). A post on the Kiro blog dated November 5, 2026 says: "Today, we're introducing Kiro bots, generally available in Kiro Crew." A bot is, per the post, "a named, long-running agent" with its own memory, its own sessions, one ongoing chat and a workspace with a dashboard. It can start several sessions in parallel, monitor them and bring results back to the chat, and it can run on schedules the user sets in the chat. The post's examples are checking a CI pipeline every 30 minutes and preparing release notes every Friday.

What the post states about control:

Tools and permissions: "Each bot gets only the tools and permissions its job needs." That is the post's description of the design. Its example is a deployment bot that "asks for your approval before each change", and a bot can ask for more tools but "nothing changes until you approve the request".
Memory: each bot has its own, and "You can view, edit, or delete anything a bot remembers."
Record of activity: scheduled activity "goes to its work log"; findings that need a decision return to the chat.
Where it runs: on a laptop, a Mac Mini or an EC2 instance, per the post.
Models: you choose the model for each bot and can pick a different one for its worker agents.
One setting is labelled Preview: a "Dynamic capabilities" toggle that lets a bot ask in chat for tools its worker needs, each still needing approval. The label appears in the description of a settings screenshot on the page, not in the body text.

Not in the launch post: a limit on the number of bots, how approvals and work-log entries are kept or audited, and any failure or accuracy data. Kiro's Crew page says Kiro Crew is free software under the Apache License 2.0 that needs a Kiro plan to run, and that a "signed audit log records every action". The launch post lists no price; Kiro's pricing page lists plans. Read November 6, it shows a Free plan with 50 credits a month and Pro at $20 per user a month with 1,000 credits, with add-on credits at $0.04 each. The licence, plan requirement and signed-audit-log statements are Kiro's own, and we did not test them. These plan prices are not a per-bot cost. The post describes what the product does, not how often it gets things right.

Verdict: Signal. It is generally available, and the design question it raises applies to any agent you leave running unattended: who approves what, and where the record lives. For operators: if your developers use Kiro, ask which bots exist, which tools each one has, who approves added tools, and who reads the work log. For the wider field, see our comparison of enterprise agent platforms.

Watch: Microsoft says Clarity's new Agent Activity dashboard shows visits from OpenAI, Google and Anthropic agents

Microsoft Clarity, a web analytics tool, published a blog post dated November 4, 2026. It says three new capabilities are "available globally to all our users": Agentic Analytics, Brand Agents and Ask Clarity. Under Agentic Analytics, Microsoft describes an Agent Activity dashboard that shows how agent traffic changes over time, which agents visit a site and what they do there, "ranging from searches and form submissions to logins, downloads, appointment bookings, and checkout". A footnote says supported agents at this time "include" Google, OpenAI and Anthropic agent operators. It also describes simulations that test whether agents can complete tasks on your site, starting with commerce and travel.

The numbers are Microsoft's. The post says weekly agent sessions "nearly doubled in three weeks to almost 2 million", citing its own analysis of 5.23 million agent sessions across 230,511 projects from August 13 to September 9, 2026. A companion Clarity post dated October 29, 2026 adds the caveats: an agent session "may also include a human handoff", Clarity "cannot currently separate" the two, and the figures "should not be interpreted as steps in a single conversion funnel or proof that an agent independently completed a task". In that post, checkout is listed at 25.21% for agentic sessions and 14.65% for human sessions. The agentic percentages are defined over all agentic sessions and the human ones over all human sessions; the post does not state those totals, and its own text calls the same figures shares of "actions". We treat them as Microsoft's own and do not compare them with the 5.2 million figure.

One line needs care. The closing sentence of the Ask Clarity section in the November 4 post says "This capability is currently in closed beta for retailers" and links a waitlist, while the post's opening says all three capabilities are available globally to all users. The post does not reconcile the two. The October 29 post calls the dashboard "generally available for projects with agentic traffic". The pages we read do not describe how providers are detected; the October 29 post says only that sessions were classified using "detected agentic browser providers". The post names only those three as supported.

Verdict: Watch. Microsoft presents it as a way to see agent traffic, but the detection method is not described and the figures are Microsoft's own. For operators: ask your web person whether your analytics can show visits from AI agents, and what share of those sessions record login or checkout events, and how your analytics defines each (an event is not a completed order). For why some sites are blocking such traffic, see our piece on banks blocking AI agents, and for a vendor-run test of agents buying things, our decode of Visa's agentic commerce benchmark.

Watch: Sierra announces Anon is joining it, to let agents sign in to websites where there is no API

Sierra's blog post dated November 5, 2026 is titled "Sierra acquires Anon", while its text says Anon "is joining Sierra". It is written from Anon's side in the first person. It does not say whether the deal has closed, and it gives no price or timeline. Anon describes its tooling as helping agents use websites the way people do, by "navigating pages and taking actions like signing in or filling out forms, even when there's no API". The post says this is for Horizon, Sierra's agents "pursuing longer-running goals, like originating a loan or getting prior authorization for a healthcare procedure", which need to work across systems "including services that don't have APIs".

The figures are Anon's own claims: it "raised more than $13M", shipped a product "used by hundreds of customers", and "completed hundreds of thousands of complex tasks in production". The post also says the best browser agents "now outperform people on many real-world tasks". The page we read gives no source for that statement. What is promised is in the future tense: "agents will be able to carry more of the work through to completion". The post says Anon's stack included "authentication and credential handling" and that its agents could handle "sensitive data and multi-factor authentication". The page we read does not say how credentials are stored, who can see them, or how this will fit into Sierra, and the page names no shipped integration and no list of customers.

Verdict: Watch. It shows where vendors are heading for work that sits behind a login with no API, but today it is an announcement. For operators: if a vendor pitches agents that sign in to portals for you, ask in writing how credentials are held and who can see what the agent did. For a different product that also operates a browser, see our teardown of Google's Computer Use tool.

Watch: Microsoft describes running Qwen3.8-27B locally through Foundry Local for GitHub Copilot, on NVIDIA GPUs with 24 GB or more

A Microsoft Foundry blog post printed "November 5th, 2026" describes running Qwen3.8-27B on a developer's own machine through Foundry Local and connecting it to GitHub Copilot with bring-your-own-key (BYOK, meaning you point Copilot at your own model endpoint). Microsoft says its optimization targets NVIDIA GPUs, and asks readers: "Have an NVIDIA GPU with at least 24 GB of VRAM?" On memory, the page says the 4-bit build is "approximately 18 GB", runnable on "consumer GPUs with 24 GB of VRAM" with context of up to 64K tokens, and that GPUs with 32 GB or more can support up to the model's maximum of 262K tokens.

Two kinds of numbers appear on the page. The benchmark table (Terminal Bench 2.1 73.0, SWE-bench Pro 61.7, NL2Repo-Bench 42.3, DeepSWE 1.1 42.2) sits on the page; the page links "Published benchmarks" to the model's Hugging Face card, and the four scores match that card. Microsoft's own test is a speed comparison with llama.cpp on an RTX 5090 and an NVIDIA DGX Spark, shown as charts without a text table of numbers, and we quote no speed numbers. The page also says local models "may have limited reasoning capabilities compared with advanced cloud models".

On maturity, the page body does not use the word preview. It states that the experience "requires Foundry Local CLI 0.13.0 or later" and links to a GitHub release tagged cli-preview-0.13.0; that release page is titled "Foundry Local CLI 0.13.0 (Preview)", is marked Pre-release and says "Expect rough edges". The page says it plans to extend support to "Macs and AMD GPUs", with no timeline. The CUDA and cuDNN runtimes must be installed separately, per the page.

Verdict: Watch, for developer teams with a suitable GPU. It is a documented route to a local coding model, on a pre-release tool, with scores that match the model's Hugging Face card. For operators: if keeping source code on your own machines matters to you, ask your developers which repositories could be tried on a local model, and do not rely on the model card's scores as a test of your code. For where this sits among coding tools, see our comparison of coding agents and our teardown of GitHub Copilot cloud agents. We do not endorse any model or vendor named here.

Do this today

Three quick checks with an IT or developer owner; this is not a security audit.

List and remove browser extensions you do not recognise (in Chrome, chrome://extensions), on every device signed in to the Claude account.
If your Claude Desktop offers an 'always allow' or auto-approve option for tool actions, review it (our suggestion; neither the researchers nor Anthropic's help page describes such a setting). The researchers report their script pressed every Allow prompt, so do not count on it.
Ask your web person whether your analytics can show visits from AI agents, and what share of those sessions record login or checkout events (an event is not a completed order).

Book an AI discovery call

What to do this week

News	Applies to	What to do now
ThisBash (Signal): researchers report a browser extension could drive Claude Desktop through Dispatch	Anyone who runs Claude Desktop, especially on a work computer	List and remove browser extensions you do not recognise, on every device signed in to the Claude account; if your Claude Desktop offers an 'always allow' or auto-approve option for tool actions, review it (our suggestion, not a documented setting). The researchers report their script pressed every Allow prompt, so do not count on it.
Kiro bots (Signal): generally available in Kiro Crew	Teams whose developers use Kiro	List the bots, the tools each has, who approves added tools and who reads the work log.
Microsoft Clarity Agent Activity dashboard (Watch)	Site owners with online checkout, booking or login	Ask your web person whether analytics can show visits from AI agents and what share of those sessions record login or checkout events.
Sierra and Anon (Watch): announced, deal status not stated	Teams buying agents that work behind logins	No action on the news; ask any such vendor in writing how credentials are held and logged.
Foundry Local with Qwen3.8-27B for GitHub Copilot (Watch): pre-release CLI, NVIDIA GPU with 24 GB or more	Developer teams considering local models	Ask which repositories could be trialled locally; do not rely on the model card's scores as a test of your code.

What Is Not Confirmed

ThisBash: whether the technique still works, Anthropic's own account of the report, whether Remote Control and Cowork sessions allow the same technique, and any real-world use.
Kiro: a per-bot cost (the pricing page lists plan prices, not bot prices), limits on bots, how the signed audit log works in practice, and any failure or accuracy data.
Clarity: how providers are detected (the October 29 post says only "detected agentic browser providers"), how much of each agent session is a human handoff, and how the closed-beta sentence closing the Ask Clarity section fits the opening statement that all three capabilities are available globally to all users.
Sierra and Anon: whether the deal has closed, its price and timeline, any shipped integration, and how credentials are stored and who can see them.
Foundry Local: Microsoft's own accuracy tests, the speed figures in text, and a date for Mac and AMD support.

One habit for all five: ask who measured each number and what the page actually says. Two longer reads published today cover other news: our decode of the WorkOS agent incident bulletins and our teardown of Gemini Omni 1.2 Flash. For yesterday's items, see the November 5 edition. If you want help placing agents in your business, see our AI agents work.

Signal / Noise (Nov 6, 2026): ThisBash and Claude Dispatch, Kiro Bots, Microsoft Clarity's Agent Dashboard