Notifications
Clear all
Topic starter
24/07/2026 4:08 pm
TL;DR: Claude Dispatch lets a phone-triggered Claude task execute on a desktop session without a user present, expanding what the agent can read, move, edit, and invoke across tools and MCP servers, according to Noma Security. The governance problem is not novelty in orchestration, but the collapse of human-paced oversight around agent actions, policy boundaries, and auditability.
NHIMG editorial — based on content published by Noma Security: Claude Dispatch and remote agent execution risk in Claude Cowork
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should security teams govern remote AI agent actions when the user is absent?
A: Treat remote agent execution as delegated authority, not background automation.
Q: Why do unattended agent workflows create more governance risk than watched sessions?
A: Because the human check that usually catches drift, misuse, or unexpected data access disappears.
Q: What do teams get wrong about approving AI tools and MCP servers?
A: They often treat approval as a one-time inventory decision.
Practitioner guidance
- Define who can trigger remote agent execution Require explicit authorization for any phone-initiated or out-of-band task that causes a desktop agent to act, and bind that trigger to the initiating identity and session purpose.
- Approve tools and MCP servers by runtime risk, not name Review each connected tool, MCP server, and plugin for the permissions it requests, the data it can reach, and whether it can chain into downstream applications.
- Correlate prompts, tool calls, and downstream effects Keep a single audit trail that links the user trigger, the model response, the agent's tool calls, and the system actions that followed.
What's in the full article
Noma Security's full post covers the operational detail this post intentionally leaves for the source:
- The exact session telemetry path from Claude Dispatch through OTEL and into the detection pipeline.
- How the Agentic Risk Map represents connected MCP servers, tools, and downstream systems for inventory and blast-radius analysis.
- The runtime enforcement split between detection mode for Cowork and Dispatch and hooks-based blocking for Claude Code.
- The specific policy categories used to approve, review, or block tools before they reach production.
👉 Read Noma Security's analysis of Claude Dispatch and remote agent execution risk →
Claude Dispatch remote execution: what it means for IAM teams?
Explore further
24/07/2026 4:13 pm
Remote execution changes the governance question from session access to delegated authority. Dispatch is not just another AI feature because it allows an agent to act when the user is absent. That breaks the assumption that interactive supervision is present during execution, which is the basis for many human IAM and workflow approvals. The practitioner implication is that authorisation must be judged by who can trigger the action and what authority the session inherits, not by whether a person logged in.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
- 91% of identity breaches involved compromised non-human identities in the latest NHIMG breach analysis, showing how quickly unmanaged machine access turns into incident exposure.
A question worth separating out:
Q: Who is accountable when an AI agent takes an unsafe action?
A: Accountability should sit with the business owner of the agent, the team that provisioned the access, and the control owners responsible for monitoring and revocation. If no one can answer who approved the identity, the scope, and the oversight model, the governance framework is not complete enough for production.
👉 Read our full editorial: Claude Dispatch expands remote agent execution risk for enterprises
