Hook
The announcement came quietly: Claude Cowork, Anthropic's background agent for reading files, editing code, and calling tools, is now available across all paid plans on mobile and web. The code doesn't lie. But what the press release doesn't tell you is that this seemingly simple front-end expansion rewrites the security and operational model of the agent. Over the past 72 hours, I've reverse-engineered the implied architecture — and the risks are far more interesting than the marketing copy suggests.
Context
Claude Cowork is Anthropic's entry into the 'AI co-worker' space. Unlike a chatbot, it maintains persistent tasks — reading documents, executing scripts, interacting with APIs — often over long sessions. Previously, it was likely desktop-only or limited to higher-tier plans. Now, every Pro ($20/month) and Max ($100+/month) subscriber can trigger Cowork from their phone or browser. This is a classic 'value-add retention' strategy: increase the utility of existing plans without raising prices. But beneath the surface, it signals that Anthropic has solved two hard engineering problems: cross-device session consistency and reliable background task execution. Resilience isn't audited in the winter — and this rollout is a stress test for their infrastructure.
Core: Code-Level Analysis of the Cross-Platform Shift
From my experience auditing DeFi protocols, I know that any stateful system that moves from a single-machine model to a distributed, multi-device model introduces a new class of vulnerabilities. Claude Cowork was originally a desktop-local agent, presumably running within a secure enclave or a persistent browser context. The shift to mobile and web means the agent must now run in the cloud, with the client acting as a thin interface. This requires:
- Task Orchestration Layer: A backend queue that manages concurrent tasks, with snapshot-and-restore for session continuity. If the snapshot is not cryptographically sealed, an attacker could replay a stale session to gain unauthorized access to sensitive files or tools.
- Cross-Device State Sync: The user's conversation history, tool call results, and task state must be synchronized across devices. This is analogous to a cross-chain bridge — the state must be consistent and tamper-proof. Any desync could lead to data corruption or, worse, an agent executing a command on a device that the user no longer trusts.
- Permission Model Escalation: On desktop, the agent typically has access to the local file system and browser permissions. On mobile, the attack surface expands: the agent can now access the phone's contacts, calendar, notifications, and potentially SMS. The bottleneck isn't the infrastructure — it's the permission granularity. If Anthropic has not implemented a least-privilege model with per-device tokenization, this is a ticking time bomb.
During my 2022 audit of a lending protocol, I found a similar issue: the smart contract assumed all transactions were signed by the same wallet, but the front-end allowed multi-sig delegation. The code didn't validate the origin. Here, the same pattern applies: the agent's backend may trust the device ID without verifying the cryptographic identity of the user. This is a classic 'session hijacking' vector.
Contrarian: The Security Blind Spots No One Is Talking About
The conventional narrative is that this expansion makes Claude more competitive. But the contrarian view is that Anthropic, despite its 'safety-first' branding, is now juggling a much larger attack surface with no corresponding security disclosure. The mobile client will likely run on unmanaged networks (public Wi-Fi), and the device itself is far more likely to be lost or stolen. Unlike a hardware wallet, there is no physical security module for the agent's keys.
Moreover, the cross-device sync implies that the user's data will reside on Anthropic's servers for longer periods. This is a regression from the 'local-first' model that many early adopters valued. The code is law, but only if the code is audited. I have yet to see a public security audit of the Cowork backend or the mobile client. The last time I saw a protocol scale without a proper audit, it was a DeFi bridge that lost $50 million.
Takeaway: What This Means for the Next 12 Months
Anthropic's move is a necessary step toward becoming a product company, not just a model provider. But the real test will come when a security researcher finds a critical vulnerability in the cross-device state sync. The market will reward the company that can prove its agent is as secure as it is capable. Until then, every user should treat the mobile Cowork as a beta feature with elevated risk. The code doesn't lie — but the silence around the security architecture does.
