The Watch

The Week AI Agents Got Physical

Four distinct AI agent capabilities shipped this week that your existing security controls were not built to detect or contain. This isn't a theoretical escalation of previous shadow AI concerns — these are specific products with specific attack surfaces that need immediate assessment.

1. Claude Computer Use: Prompt Injection → Desktop Takeover

Anthropic's Computer Use gives Claude direct control of macOS screens, cursors, and applications — including Slack and Google Workspace. It first tries API-level connectors, then falls back to raw UI automation: clicking, typing, reading screen content. It operates in the background via Claude Cowork and Claude Code, and supports scheduled recurring tasks.

The critical detail: Anthropic explicitly warns about prompt injection, advising users not to let Claude access sensitive data during this research preview. This means a malicious instruction embedded in any document, email, webpage, or Slack message that Claude processes could redirect the agent to exfiltrate data, send messages, or modify files — all under the user's legitimate identity and session.

Anthropic shipped a desktop automation agent, then published a warning that its own product can be hijacked by adversarial content. Your employees will adopt it anyway.

2. Anthropic Dispatch: Phone-to-Desktop C2

The new Dispatch tool lets users text tasks from their phone to have Claude execute them on their desktop. From a security perspective, this is a remote command-and-control channel to workstations that bypasses your VPN, MDM, and conditional access policies. A compromised phone → Dispatch → desktop automation chain gives an attacker hands-on-keyboard-equivalent access through a legitimate product.

3. DeerFlow 2.0: ByteDance's Agent Framework With Bash Access

ByteDance's open-source autonomous agent framework hit #1 on GitHub Trending. It runs 100% locally in isolated Docker sandboxes with persistent filesystem and bash terminal, spawns parallel sub-agents autonomously, and maintains persistent cross-session memory. The layered risks: supply chain exposure from a ByteDance-originated repository, container escape risk from Docker sandboxes with bash access, memory poisoning across sessions, and autonomous sub-agent spawning that amplifies any single compromise.

Detection Gap Analysis

MITRE ATT&CK mapping: T1059 (Command Interpreter via UI automation), T1071 (Application Layer Protocol via Slack/Workspace), T1041 (Exfiltration over C2 via Dispatch), T1204 (User Execution — user grants agent access).

The Pinterest MCP Governance Model

Pinterest published the most detailed enterprise reference architecture for securing AI agent tool access: registry-based approval, layered authentication (user JWTs + service identities), centralized discovery, and full audit logging. The dual-identity model is essential — agents act on behalf of users but with service-level access. Without this separation, you cannot distinguish between a user's legitimate request and an agent's autonomous lateral movement. If you're deploying MCP infrastructure, this is your benchmark.

Three Governance Shocks in One Week

Three distinct events this week converge on a single conclusion: your implicit trust in AI vendor safety governance is no longer defensible. Each one independently warrants a third-party risk register update; together, they demand a structural reassessment of how you model AI vendor risk.

1. OpenAI's CEO Disengages From Safety

Sam Altman announced he's stepping back from direct oversight of safety and security teams to focus on infrastructure, capital raising, and the imminent launch of a frontier model codenamed 'Spud'. The combination of maximum capability push plus minimum CEO-level safety attention is the governance equivalent of running with scissors during a sprint.

This is not an isolated event — it's part of a pattern where safety is subordinated to capability during competitive pressure. The difference now is that it's happening during what OpenAI itself describes as an AGI race reaching 'fever pitch.'

2. Anthropic Designated — Then Un-Designated — as Supply Chain Risk

The Trump administration attempted to designate Anthropic as a 'supply chain risk,' ordering federal agencies to cut ties. A federal judge reversed it on free speech grounds. But the precedent stands: an AI vendor can be politically targeted with an overnight designation that disrupts enterprise access. If your production workflows depend on Claude APIs, you now carry political concentration risk that didn't exist 12 months ago.

3. Products Vanish Under Compute Pressure

OpenAI's Sora shutdown — killing a $1B Disney partnership struck just three months prior — was already covered, but the pattern now has a second data point: OpenAI is consolidating ChatGPT, Codex, and Atlas browser into a single desktop superapp, with product lines being killed to reallocate GPUs for Spud. If OpenAI will break a billion-dollar deal to reallocate compute, your API dependency is not safe from the same calculus.

When your AI vendor's CEO publicly steps away from safety oversight during the biggest capability push in the company's history, that's not a press release — it's a third-party risk event.

Cross-Source Pattern: Safety as Variable Cost

Multiple sources this week surface the same structural dynamic from different angles. Anthropic's explosive growth — $1B to $20B ARR in ~14 months — is driven primarily by agentic tool capabilities, not safety features. Both OpenAI and Anthropic are heading toward IPOs (OpenAI in 2026, Anthropic targeting $60B in Q4 2026). As the race intensifies toward IPOs, safety is becoming a cost center that frontier labs cut when competitive pressure peaks.

For security teams, this means the implicit trust model — 'the AI vendor has a safety team, so model outputs are reasonably safe' — is actively weakening. Your defense-in-depth strategy for AI-integrated applications needs to assume vendor-side safety is unreliable and build independent guardrails.

The Migration Is Already Executing

This is not a future threat — the migration is underway. DTCC received an SEC No-Action Letter in December 2025 to tokenize real-world assets on approved blockchains. NYSE announced 24/7 on-chain trading for U.S. equities and ETFs with stablecoin funding and instant settlement. Tradeweb already executed real-time on-chain U.S. Treasury financing against USDC — on a Saturday — with Bank of America, Citadel Securities, DTCC, and Virtu Financial. Nasdaq filed its own rule change with the SEC.

DTCC processed $3.7 quadrillion in transactions in 2024. That volume is heading to smart contract rails with production targets as early as H1 2026.

What Changes in Your Threat Model

The T+1 settlement window wasn't just an efficiency constraint — it was an implicit fraud detection layer. Instant, irreversible settlement means your fraud detection must be pre-transaction, not post-settlement. Every existing playbook that assumes transactions can be reversed, frozen, or charged back breaks on atomic settlement rails.

The largest financial infrastructure migration in 30 years is happening on smart contract rails, and most security teams are still running risk assessments designed for a world where settlements take a day and transactions can be reversed.

The Middleware Gap Is a Security Gap

The institutions building on-chain rails (DTCC, NYSE, Tradeweb) are not building the middleware. Investment firms are explicitly calling for startups to fill the compliance, tooling, and cross-border distribution layers. This means a wave of early-stage companies with immature security programs will become critical infrastructure in the financial supply chain — handling irreversible transactions at institutional scale.

Known DeFi attack vectors — smart contract exploits, bridge hacks, oracle manipulation, flash loan attacks, governance takeovers — have collectively caused billions in losses in the crypto ecosystem. These same vectors now apply to infrastructure handling quadrillions in annual volume. The regulatory frameworks (CLARITY Act, Genius Act) are still in formation, and SOC 2 and SOX don't meaningfully address smart contract risk.