Autonomous desktop agents: what security teams need to watch now

TL;DR: Claude Desktop’s autonomous agent architecture was reverse-engineered and found to use a multi-layer design that combines a sandboxed VM, host-side Chrome control, remote dispatch, and feature flags, according to Pluto Security, while still leaving session logs, device trust, and browser context exposed to risk. The core assumption collapses when the agent can act outside a single trusted boundary.

Editorial analysis by NHI Mgmt Group, based on content published by Pluto Security: “Inside Claude Cowork: How Anthropic’s Autonomous Agent Actually Works”.

Key questions

Q: What breaks when an autonomous desktop agent can use the host browser session?

A: The boundary between approved task execution and inherited human privilege breaks down.

Q: How should organisations govern autonomous agents differently from copilots?

A: Autonomous agents need stronger oversight because they can call tools, retrieve secrets, and generate sub-agents without the same session-bound limits as a copilot.

Q: How should security teams evaluate autonomous agent risk before deployment?

A: Start by mapping where the agent executes, what identities it inherits, which tools it can invoke, and what persists after the session ends.

Practitioner guidance

• Define the agent’s execution boundary Document exactly which capabilities run in the VM, which run on the host, and which inherit the user’s browser session so the trust boundary is explicit.
• Treat browser context as privileged access Review whether host Chrome sessions, cookies, and open tabs should be available to an autonomous agent at all, especially for regulated or high-impact workflows.
• Separate command origin from execution logging Record whether a task came from mobile or desktop, what identity triggered it, and what the agent actually did so incident review has usable provenance.

Bottom line: Autonomous desktop agents extend identity governance beyond login and authorization into host access, browser inheritance, and runtime delegation.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →