The Register reports that Anthropic has chosen not to fix a security flaw in its Claude Dispatch feature, describing a route from a privilege escalation issue to full remote code execution in what it calls "six simple steps". According to the report, the flaw could let an attacker run commands across what should be separate corporate boundaries.
Steve Burns, EAC Network Solutions: For law firms and accountancy practices, the relevant question is not whether you use Claude directly, but whether any supplier touching your client documents does. Many practice management, document management and research tools now build in AI agents, and firms rarely know exactly what those agents can reach or where their access boundaries sit. If a vulnerability of this kind goes unfixed by the AI provider itself, the safeguard has to come from how your suppliers have configured and limited that access, not from the provider patching it later. Firms should ask their software suppliers directly whether any AI features in use are built on Claude or similar agent based tools, and specifically whether those tools can cross between separate clients’ files or matters. Where client confidentiality is the basis of the relationship, as it is for solicitors and accountants, that answer needs to be in writing, not assumed.
Source: The Register
