I approved an AI agent action from my phone recently. One tap: “Allow for this site.” The full URL, parameters and all, sat behind an expand button I didn’t press.
That same chat can reach my laptop’s browser, my local files, and every connector I’ve authorized.
This is no longer a theoretical security edge case. Anthropic recently removed the boundary between chat and agentic execution entirely with their “Claude Cowork and chat are one Claude” update. A single conversation thread now spans web, mobile, and desktop. A casual query typed from an iPhone can trigger multi-step workflows that inspect your local files, drive computer-use sessions, or pull records through third-party connectors.
Autonomy is leverage, and leverage is debt. It’s how companies reach outsized valuations. It’s also how they go under when risk isn’t priced.
The mobile pattern isn’t new. Business email compromise (BEC) cost U.S. victims $3.05B in 2025, per the FBI’s IC3 report. Small screens made it easier: truncated sender addresses, hidden URLs, one missed letter in a domain.
AI approvals are heading down the exact same track.
There is no zero-risk setting, only gradients. Here is how I price it:
1. Separate browser profile
Log in only to the specific sessions the agent reuses. Keep password managers, personal banking, and healthcare completely isolated.
2. Tiered approvals and review discipline
Read-only sources like nist.gov get site-level approval. Anything that writes, sends, purchases, or modifies settings gets approved per action. Verify the domain letter by letter, check attachments, and confirm the destination. Agents simply let you make the BEC mistake faster.
3. Least privilege on connectors
Every authorized connector is reachable from your mobile device. Consider the worst-case blast radius if the agent gets steered. A connector that can write or send can impersonate you.
4. Contain desktop exposure
Mac Accessibility and Screen Recording permissions grant broad visibility. Keep them off by default, enable them only for a specific task, and disable them immediately after. Quit the agent overnight or while traveling. Focus on position limits rather than complete abstinence.
5. Break the lethal trifecta
Simon Willison defined the lethal combination: private data, untrusted content, and a way to exfiltrate data out. Combining mobile, desktop, and cloud connectors places all three in a single chat. Prompt injection cannot be reliably filtered at the model layer today, so break the chain architecturally: separate the reading from the execution.
6. Treat your AI client like a banking app
On iOS, require Face ID on launch via a long-press on the app icon. An application with access to drive your desktop deserves the same barrier as your financial accounts.
Debt isn’t the problem.
Unpriced debt is.
References
- Anthropic Support (September 16, 2026): “Claude Cowork and chat are one Claude”
- Simon Willison (June 16, 2025): “The lethal trifecta for AI agents: private data, untrusted content, and external communication”
- Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3): 2025 Internet Crime Report
Setting guardrails like these for a team is part of my AI Governance & Agentic AI Security Readiness Sprint.
