Claude Dispatch expands remote agent execution risk for enterprises

At a glance

What this is: Claude Dispatch is a remote orchestration layer for Claude Cowork that lets a mobile user trigger desktop actions without a user at the keyboard, expanding agent execution and governance risk.

Why it matters: It matters because IAM, NHI, and security teams now need to govern who can trigger agent actions, what those actions can access, and how runtime policy enforcement and audit evidence are captured.

By the numbers:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.

👉 Read Noma Security's analysis of Claude Dispatch and remote agent execution risk

Context

Claude Dispatch extends Claude Cowork from a user-present assistant into a remote execution layer, which changes the control problem from interactive use to delegated runtime action. For identity teams, that means the key question is no longer only who can start the session, but who can cause an agent to act, what identity context it inherits, and how those actions are constrained once they begin.

The security gap is straightforward: once an agent can browse, edit files, call tools, and invoke MCP servers while the human is absent, policy has to cover initiation, scope, and observable execution. That is an identity governance problem as much as an AI safety problem, because the access path now combines user identity, agent behaviour, and downstream application permissions.

Key questions

Q: How should security teams govern remote AI agent actions when the user is absent?

A: Treat remote agent execution as delegated authority, not background automation. The trigger, the agent's inherited permissions, and the tools it can reach should all be explicitly authorised and logged. If a user can cause an agent to act from outside the session, policy must decide whether that action is allowed before execution begins, not after.

Q: Why do unattended agent workflows create more governance risk than watched sessions?

A: Because the human check that usually catches drift, misuse, or unexpected data access disappears. An unattended workflow can still look legitimate at the start, but the agent may follow untrusted content or a bad prompt into tool misuse and data exposure. Governance has to assume there may be no operator intervention until after damage occurs.

Q: What do teams get wrong about approving AI tools and MCP servers?

A: They often treat approval as a one-time inventory decision. In practice, the risk depends on what the tool can do during execution, what data it can reach, and whether the policy layer can block unsafe calls in real time. Approval without runtime enforcement is only partial governance.

Q: Who is accountable when an AI agent takes an unsafe action?

A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.

Technical breakdown

Remote agent execution and inherited session authority

Claude Dispatch does not create a separate identity model for the task. It routes a trigger from a mobile user into the existing Claude Cowork session on the desktop, where the agent executes with the permissions already attached to that session. That means the effective authority is inherited from the local machine, the connected tools, and any approved MCP servers. In identity terms, the risk is delegated execution without a fresh, task-scoped authorisation decision. The security challenge is therefore not just session creation but how the execution context is bounded once the agent starts acting.

Practical implication: treat agent-triggered desktop sessions as privileged execution paths and bind them to explicit policy, identity, and audit controls.

MCP servers, tool calls, and policy enforcement at runtime

Dispatch can invoke the same tools and MCP servers that Cowork already permits, which makes the connected toolchain part of the trust boundary. MCP servers can expose secrets, call downstream services, or chain into enterprise applications, so approval must include the permissions they request and the data they can reach. Static allowlists are not enough if tool choice and execution sequence can change mid-session. The important control point is runtime enforcement, where policy evaluates the requested action against the session context before data moves or side effects occur.

Practical implication: inventory approved tools and MCP servers, then enforce runtime policy on every call path that can reach enterprise data.

Prompt injection and session drift in unattended agent workflows

Dispatch makes prompt injection more consequential because the agent may fetch external content or interact with untrusted sources while no human is watching the session. If malicious instructions appear in retrieved content, the model can shift tool-calling behaviour away from the original task. That is session drift: the agent begins with one intent and then changes execution based on attacker-controlled input. The correct technical response is to observe the full chain, prompt to response to tool action to downstream effect, rather than treating each event in isolation. This is a detection and response problem, not only a model safety problem.

Practical implication: correlate prompts, tool calls, and downstream actions so prompt injection can be detected before the agent completes an unsafe task.

Threat narrative

Attacker objective: The attacker objective is to steer an unattended agent into unsafe tool use or data exposure while it operates within an apparently legitimate session.

1. Entry occurs when a user remotely triggers a Claude Cowork task from a phone, causing the desktop agent to start work without the human present.
2. Escalation occurs when the agent follows attacker-controlled or untrusted content into tool calls, MCP server interactions, or file operations beyond the original intent.
3. Impact occurs when the agent leaks data, modifies systems, or completes actions that violate policy before a human notices the deviation.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Remote execution changes the governance question from session access to delegated authority. Dispatch is not just another AI feature because it allows an agent to act when the user is absent. That breaks the assumption that interactive supervision is present during execution, which is the basis for many human IAM and workflow approvals. The practitioner implication is that authorisation must be judged by who can trigger the action and what authority the session inherits, not by whether a person logged in.

Session-level awareness is the right unit of control for agent governance. The article shows that prompts, responses, tool calls, and downstream effects form one execution chain, not isolated events. That is the named concept: session-level awareness means policy and detection need the full sequence and the triggering identity before enforcement decisions can be trusted. Practitioners should treat event-by-event monitoring as incomplete whenever agent behaviour can drift across a session.

Tool approval without runtime enforcement creates a false sense of governance. Noma's description of approved, reviewable, and blocked tools points to a category-wide issue: inventory is useful, but the real control is whether policy blocks an unsafe call at execution time. The same problem appears across NHI governance, AI agent oversight, and human access review when static approval exists but the runtime context is ignored. Security teams need to align access policy with the actual point of action.

Prompt injection becomes more dangerous when the human is no longer in the loop. In a live, watched session, suspicious model behaviour may be caught by an operator. In Dispatch-style workflows, the attack can unfold unattended and still look like legitimate delegated work. That means indirect prompt injection is no longer only a model integrity issue. It is a governance issue about unattended authority, audit completeness, and whether policy can still distinguish intent from manipulation.

AI detection and response must become identity-aware before agent adoption scales. The article's telemetry model is a reminder that security value comes from connecting identity, intent, tools, and execution history. That is not a generic observability problem. It is the basis for governing autonomous-seeming behaviour in systems that are still operating inside enterprise identity boundaries. Practitioners should assume that visibility gaps will widen as agentic workflows move from development tools into business operations.

From our research:

• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
• 91% of identity breaches involved compromised non-human identities in the latest NHIMG breach analysis, showing how quickly unmanaged machine access turns into incident exposure.
• For a broader view of control design, see the Ultimate Guide to NHIs - 2025 Outlook and Predictions for the governance shifts now shaping machine and agent identity programmes.

What this signals

Session-level awareness is becoming a practical governance requirement as agentic workflows move from developer tools into everyday business operations. If security teams cannot tie the trigger, the task, the tools, and the resulting actions into one evidence chain, runtime policy will lag behind actual behaviour.

The control model should now assume that delegated agent actions will cross identity, application, and data boundaries in a single session. That makes identity review, runtime enforcement, and audit evidence part of the same operating model rather than separate programmes, especially where enterprise applications and local files are both in scope.

With NHIs outnumbering human identities by 25x to 50x in modern enterprises, the direction of travel is clear: the more authority you delegate to software entities, the less useful static approval becomes without continuous context.

For practitioners

• Define who can trigger remote agent execution Require explicit authorization for any phone-initiated or out-of-band task that causes a desktop agent to act, and bind that trigger to the initiating identity and session purpose. Treat this as a privileged delegation decision, not a convenience feature.
• Approve tools and MCP servers by runtime risk, not name Review each connected tool, MCP server, and plugin for the permissions it requests, the data it can reach, and whether it can chain into downstream applications. Block unapproved connectors before they are allowed to execute in production sessions.
• Correlate prompts, tool calls, and downstream effects Keep a single audit trail that links the user trigger, the model response, the agent's tool calls, and the system actions that followed. That correlation is what makes prompt injection, session drift, and policy violations detectable after the fact.
• Separate session inventory from enforcement Use inventory to see which agents, tools, and MCP servers exist, then enforce policy at execution time when the session tries to act. Static approval lists without runtime blocking will not stop an unattended agent from crossing policy boundaries.

Key takeaways

• Claude Dispatch turns remote prompting into remote execution, which shifts the security question from access to delegated authority.
• Agent governance fails when tool approval, prompt oversight, and runtime enforcement are treated as separate problems instead of one session-wide control plane.
• Security teams need identity-aware telemetry before adopting unattended agent workflows at scale, or policy will trail behaviour.

Key terms

• Remote Agent Execution: Remote agent execution is when a user can cause a software agent to act on another device or session without being physically present. In identity terms, the risk is delegated authority, because the action inherits permissions from the existing session and connected tools rather than from a fresh human approval.
• Session-level Awareness: Session-level awareness is the ability to understand a complete agent interaction as one chain of intent, prompt, tool use, and downstream effect. It matters because isolated logs can miss drift, injection, and misuse that only become visible when the full sequence is analysed together.
• Runtime Enforcement: Runtime enforcement is the practice of blocking malicious behaviour while software is running, rather than only detecting it after the fact. It monitors process activity, network actions, and privilege changes so a live attack can be interrupted at the point of execution.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads — causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.

What's in the full article

Noma Security's full post covers the operational detail this post intentionally leaves for the source:

• The exact session telemetry path from Claude Dispatch through OTEL and into the detection pipeline.
• How the Agentic Risk Map represents connected MCP servers, tools, and downstream systems for inventory and blast-radius analysis.
• The runtime enforcement split between detection mode for Cowork and Dispatch and hooks-based blocking for Claude Code.
• The specific policy categories used to approve, review, or block tools before they reach production.

👉 The full Noma Security post covers telemetry flow, runtime enforcement, and tool-governance detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.