Hook
Anthropic just flipped the switch for Claude Cowork across all paid plans—mobile and web included. On the surface, a routine product expansion. But the hidden latency in task orchestration between devices screams of a vulnerability pattern I’ve seen in DeFi liquidation bots. When an AI agent moves from your desktop to your pocket, the attack surface doesn’t just shift—it multiplies. I’ve spent the past four years auditing smart contracts that pretend to handle cross-chain state, and the same race condition bugs are now migrating into AI-agent middleware. The question isn’t whether Claude can code; it’s whether your job can be front-run.
Context
Claude Cowork is Anthropic’s “AI coworker” feature—a persistent agent that reads files, edits documents, calls APIs, and executes multi-step tasks in the background. Until now, it was desktop-only, presumably because the agent required a stable local execution environment. The expansion to mobile and web means the agent now runs on Anthropic’s cloud, with the front-end acting as a thin client. This is a fundamental architectural shift: from local-first to cloud-first, with async task queues and session snapshots syncing across devices. The move is aimed at knowledge workers who switch between laptop, phone, and tablet—a demographic that overlaps heavily with crypto-native traders and developers who already live in multi-device workflows. But the blockchain industry has learned the hard way that any state machine that spans multiple endpoints invites a new class of exploits.
Core
Let me walk through the architectural implications the way I would dissect a Uniswap V4 hook. Claude Cowork’s core logic is now a stateful service running on Anthropic’s backend. When a user starts a task on mobile, say “analyze this spreadsheet and draft an email,” the agent spawns a session. That session maintains a context window, tool call stack, and file references. The mobile device sends a request, receives incremental updates, and may push new instructions mid-task. This is semantically identical to a multi-signature smart contract where each device is a signer, and the backend is the executor. The difference? In DeFi, you have revert guards and gas limits. In AI-agent orchestration, you have soft timeouts and best-effort consistency.
From my audits of AI-agent protocols last year, I identified a critical race condition: when a user issues a command on one device while the agent is still processing a prior command from another device, the session state can diverge. The backend must either queue or merge—but the merge logic is often naive. I’ve seen this in NFT minting contracts where two transactions from the same wallet reorder the state. The fix is a mutex lock, but Anthropic hasn’t published any details on session locking. Based on the timeline of their expansion, they likely rely on a single-threaded event loop per user—which works until a user opens two tabs on two devices simultaneously. The resulting state corruption could lead to unintended tool calls, like sending an email with the wrong attachment or executing a trade on a DeFi protocol with incorrect parameters.
Then there’s the cost side. Every mobile request triggers a full inference cycle on the backend. A single Cowork task—say, summarizing a 50-page PDF and generating a report—can consume 10x the compute of a standard chat. For a user with a $20/month Pro plan, Anthropic’s margin per task is razor-thin. The math is harsh: if a Pro user runs 100 Cowork tasks per month, each task costs roughly $0.20 in inference. But AWS GPU rental for a single H100 can run $3/hour, and a heavy task might take 2 minutes. That’s $0.10 in raw compute, plus storage, bandwidth, and orchestration overhead. The $20 subscription barely covers 100 tasks, let alone the unlimited usage implied by “all paid plans.” The only way this works is if Anthropic cross-subsidizes with Max subscriptions ($100/month) or limits task frequency. The lack of transparent rate limits is a red flag—it reminds me of the early days of DeFi yield aggregators that promised “unlimited” vaults but silently capped deposits after the first million.
Contrarian
Here’s where the narrative flips: most analysts will praise this as a “stickiness” play. I see it as a forced upgrade path disguised as generosity. By making Cowork available to all paid plans, Anthropic creates a situation where Pro users hit the compute ceiling and feel compelled to upgrade to Max. The real product isn’t the agent—it’s the tiered pricing engine. Sound familiar? It’s the same playbook as centralized exchanges: offer free withdrawals, then throttle after a certain volume. The difference is that in crypto, you can verify the on-chain state. In AI, the state is opaque. Users trust that Anthropic isn’t deliberately slowing down Pro tasks to nudge them toward Max. Given the company’s history of “safety-first” marketing, any whisper of throttling could erode the trust premium they’ve built.
Moreover, the mobile expansion introduces a new attack vector that I haven’t seen discussed: ambient audio and camera access. The Claude mobile app (if it’s a standalone app) can request microphone and camera permissions. An agent that can read your screen or listen to a meeting is a powerful tool—but also a target. If a malicious actor compromises the mobile app’s session token, they could inject commands that record audio and exfiltrate it via the agent’s API. This is more than a theoretical risk. During my security review of a crypto AI-agent startup last year, the team had a vulnerability where the agent’s long-lived API key was stored in plaintext in the app’s local storage. Anthropic is more sophisticated, but the principle remains: the more endpoints, the more opportunities for credential theft.
Takeaway
Claude Cowork’s cross-platform expansion is a milestone in product breadth, but it’s also a stress test for Anthropic’s infrastructure and security model. The real question isn’t whether it will boost adoption—it will. The question is whether the hidden costs—both in compute and in vulnerability surface—will catch up before the next funding round. I’ll be watching for three signals: (1) a public session management audit, (2) transparent rate limits per plan, and (3) any reports of cross-device task corruption. If any of these appear, the narrative will shift from “AI coworker” to “AI liability.” Code is law, but bugs are the human exception. The ledger remembers what the wallet forgets.
