Anthropic launched Remote Control for Claude Code, enabling developers to manage AI-assisted coding sessions from mobile devices. While the feature offers genuine engineering benefits, it introduces significant security governance challenges that organizations need to address before this capability reaches Team and Enterprise plans.
What Remote Control Does
The system creates a synchronization layer — not cloud computing. "Your code never leaves your machine." A secure tunnel connects local terminal sessions to Claude's mobile or web interface through outbound HTTPS connections using short-lived, scoped credentials. No inbound ports require opening.
The engineering is thoughtful. The security implications are not trivial.
Five Critical Security Risks
Mobile Device Exposure
An autonomous agent with full filesystem and configuration access becomes reachable from personal iPhones, tablets, and unsecured networks. Compromised mobile devices — whether through outdated OS versions, malicious apps, or network interception — provide windows into active agents with extensive local permissions.
Weak Access Controls
Session URLs serve as the sole authentication mechanism. There is no multi-factor authentication, no device binding, no IP scoping, no conditional access policy. Anthropic's own documentation acknowledges that "the session URL should be treated like a password." The problem is that passwords have decades of enterprise controls built around them. Session URLs do not.
These credentials frequently appear in messaging platform logs, browser histories, and screenshots — exactly the places that endpoint detection tools monitor for credential exposure.
Shadow IT Visibility Gaps
Remote Control isn't available on Team or Enterprise plans at launch. That means developers using this capability are doing so via personal Pro or Max subscriptions — outside organizational logging, outside data loss prevention coverage, and outside the audit trails that security teams can observe. This is a textbook shadow IT scenario, with the added complexity that the tool in question has autonomous capabilities.
MCP Server Vulnerabilities
Claude Code's connected integrations — databases, internal APIs, code repositories, productivity tools — remain active during remote sessions. Claude's autonomous capabilities can interact with these systems independently. This creates prompt injection risks: a carefully crafted input delivered through a remote session could direct the agent to take actions against connected systems that the developer never intended.
Immature Security Posture
Research preview status means incomplete security hardening. Known bugs appeared on day one. Session reconnection behavior after network drops raises unresolved questions about timeout persistence and edge case handling. This is not a tool that has completed enterprise security review cycles.
What Security Teams Should Do Now
-
Update acceptable use policies to address agentic AI tools with remote access capabilities. Most AUPs predate this category of tool entirely.
-
Inventory Claude Code usage across your organization. You may have more Pro and Max subscribers than you realize, and the shadow IT surface area may already be larger than expected.
-
Review developer MCP configurations. Understand what integrations are active and what blast radius a compromised session would have.
-
Engage development teams proactively. This capability will expand. Getting ahead of governance now is easier than enforcing controls retroactively after the Team and Enterprise rollout.
-
Query your CASB and DLP vendors about Anthropic API visibility. If they don't have coverage, request a roadmap.
-
Monitor the Team and Enterprise rollout closely. When organizational accounts gain access, the expectation is that enterprise-grade controls — logging, audit trails, session management — arrive with it. Hold Anthropic to that expectation.
The Bottom Line
"Reasonable for a developer tool" and "acceptable enterprise security posture" are different standards. Remote Control clears the first bar. It does not yet clear the second. The goal here is informed governance, not reflexive prohibition — but informed governance requires visibility, policy, and controls that most organizations haven't built yet for this class of tool.
Start now.