Artificial intelligence is no longer confined to the browser tab or the desktop window. Anthropic appears to be taking its Claude Cowork agentic platform mobile — and while the feature promises genuine productivity gains, it also introduces a new attack surface that security professionals would be wise to examine before deployment scales.
What Claude Cowork Actually Does
Before assessing the implications, it's worth understanding what distinguishes Cowork from a standard chatbot interaction. Most AI assistants operate in a simple request-response loop: a user submits a prompt, the model returns an answer, and the session ends. Cowork operates differently. It is designed for sustained, multi-step task execution — reading and writing local files, generating documents and spreadsheets, analyzing folder structures, and continuing to operate in the background while the user attends to other work.
Critically, Cowork runs directly on the host machine, not in a sandboxed cloud environment. That architectural choice gives it access to the file system the user explicitly grants — but it also means the agent has a persistent foothold on the endpoint for the duration of a task.
The Mobile Extension: Remote Control, Not Remote Execution
Based on interface screenshots that have surfaced publicly, Anthropic's mobile implementation of Cowork appears carefully scoped. The mobile experience is not intended to transform a smartphone into an independent agentic platform. Instead, it functions more like a management console — a remote control that allows users to initiate, monitor, and steer tasks that are physically executing on a paired desktop or laptop.
The underlying compute and file access remain anchored to the user's computer. The phone becomes a window into that process, not the engine driving it.
This distinction matters enormously from a security standpoint. A fully mobile-native agentic platform would raise immediate concerns about mobile OS sandboxing, app permissions, and on-device data handling. The remote-management model shifts the security conversation back to the desktop — where, frankly, the risks are already more familiar territory for enterprise defenders.
The Security Implications Security Teams Should Not Ignore
Persistent Background Execution
Cowork tasks continue running even after the user closes the application. From a user-experience perspective, this is a feature. From a security perspective, it means an AI agent maintains an active session on the endpoint without requiring ongoing user interaction. If that session is hijacked, manipulated through prompt injection, or fed malicious file content mid-task, the damage could propagate silently before any human notices.
The Mobile Authentication Gap
Allowing a mobile device to initiate or steer file-system-level AI tasks introduces a new authentication dependency. If an attacker gains access to a user's Claude mobile session — through a compromised account, a stolen session token, or SIM-swapping — they potentially inherit the ability to direct an agent operating on a corporate endpoint. The security of the desktop task is now partially contingent on the security of the mobile account.
File Access Scope Creep
Agentic systems that traverse local file systems have a well-documented tendency toward scope expansion. A task initiated to compile a report may, in pursuit of relevant context, access directories the user did not consciously intend to expose. Organizations deploying Cowork should establish clear data governance policies around which directories the agent is permitted to access — and audit those boundaries regularly.
Cross-Device Session Continuity
The ability to "check in from your phone, browser, or Claude Desktop" implies session state is synchronized across devices. That synchronization layer is a potential interception point. Any data passed between the desktop agent and the mobile management interface should be treated as sensitive telemetry and evaluated accordingly.
The Broader Pattern: AI Agents Are Going Ambient
Cowork's mobile expansion is not an isolated product decision — it reflects an industry-wide trajectory. AI agents are moving from discrete, user-initiated interactions toward ambient, always-on processes that blend into the background of daily work. Microsoft's Copilot, Google's Project Mariner, and now Anthropic's Cowork are all pushing toward a model where AI operates continuously, across devices, with persistent access to user data and system resources.
For security teams, this trend demands a fundamental reassessment of how AI tools are classified in the enterprise risk model. These are no longer productivity applications with read-only data exposure — they are active agents with write access, execution capabilities, and increasingly, cross-device reach.
What You Should Do
Anthropic's engineers have clearly thought carefully about keeping heavy computation on the desktop rather than the phone. That restraint is commendable. But as organizations begin piloting mobile Cowork access, security teams should be present at the table — not catching up after deployment.
