Anthropic pushed Claude Cowork to mobile and web. The announcement was a single paragraph: "available to all paid plans." No changelog. No security audit. No mention of the new trust assumptions.
Code does not lie, but it does hide. The hidden variable here is the expansion of the attack surface. Every new endpoint is a potential reentrancy vector. Every mobile session is a new entry point for data exfiltration. From my years auditing DeFi protocols, I learned one rule: the moment you add a cross-chain bridge, you inherit the security of the weakest chain. The same applies here.
Context: The Product That Wasn't Mobile
Claude Cowork is an AI agent designed for collaborative work. It reads files, edits code, calls tools, and maintains long-running tasks. Previously, it lived on the desktop. The user had to be at a terminal to delegate tasks. Now, the same agent can be summoned from a phone browser or a native app. The value proposition is obvious: mobility. The hidden cost is not.
Anthropic's infrastructure must now support session persistence across devices, task orchestration from unreliable networks, and real-time state synchronization. These are engineering challenges. But they are also security challenges. The backend now holds a continuous session buffer. If compromised, an attacker can replay the entire work history. The system assumes the mobile device is trusted. That is a dangerous assumption.
Core: The Engineering Autopsy
Let's dissect the architecture. Claude Cowork on desktop used a local-first approach: the agent ran on the user's machine, calling APIs as needed. The mobile/web version shifts to a cloud-first model. The agent runs on Anthropic's servers. The user's device is just a thin client. This is a fundamental change in the trust model.
From my work on the Poly Network post-mortem, I know that every cross-domain state transition introduces a new attack surface. Here, the state transition is the session snapshot. When a user pauses a task on desktop and resumes on mobile, the session state must be serialized, transmitted, and deserialized. If the serialization is not atomic, an attacker can inject malicious state. This is equivalent to a cross-chain bridge vulnerability.
Additionally, the mobile notification channel is a new oracle. The agent can push notifications to the user's phone. This creates a feedback loop that can be exploited. Imagine an attacker who triggers a malicious notification that leads the user to a fake login page. The agent's trust in the device becomes the attacker's lever.
Mathematical Proof: The Risk Multiplier
Let $S$ be the original attack surface of the desktop client. The mobile/web expansion adds three new dimensions: network exposure ($N$), device diversity ($D$), and session state persistence ($P$). The total new attack surface $S'$ is approximately $S \times (1 + N + D + P)$. Based on typical mobile app vulnerabilities, I estimate $N \approx 0.5$, $D \approx 1.0$, and $P \approx 0.8$. This gives a multiplier of $3.3$. The attack surface has grown by over 200%.
This is not a theoretical exercise. In 2020, I simulated flash loan attacks on Curve's stabilizer. The result was always the same: the more entry points, the more ways to manipulate the invariant. Here, the invariant is user trust. Every new device is a potential oracle manipulation.
Contrarian: The Convenience Trap
The mainstream narrative will celebrate this as a step toward ubiquitous AI assistance. "Now you can have your AI coworker with you everywhere." I disagree. This is a defensive move, not an innovation. OpenAI's ChatGPT has had mobile and web support for years. Anthropic is catching up, not leading.
The real blind spot is the assumption that users will understand the security implications. They will not. They will grant the mobile agent access to their email, calendar, and files. They will use it on public Wi-Fi. They will forget to log out. The agent will remember everything.
Root keys are merely trust in hexadecimal form. Here, the trust is in the form of a mobile app permission. It is far more dangerous because it is invisible. The user never sees the attacker's code. They only see the agent's output.
Takeaway: The Inevitable Incident
Within 12 months, I predict a high-profile security incident involving a mobile AI agent. It will not be a model hallucination. It will be a session hijack or a data leak through a notification channel. The industry will then scramble to retrofit security. But by then, the damage will be done.
Anthropic's move is a calculated risk. It increases adoption and revenue. But the cost will be paid in trust. Security is a process, not a product. The process here is incomplete. The mobile agent is a black box with a new set of keys. The only question is who finds the lock first.
Velocity exposes what static analysis cannot see. The mobile agent's velocity is the speed of a push notification. That is faster than any audit cycle.