Two months ago, I posted the crackpot hypothesis that Claude Code is an intentional vector to give Anthropic access to orchestrate code execution on many machines that have access to important things. I listed some observations (e.g. “Claude Code is not source-visible despite being security critical”, “Claude Code is mandatory if you want a subscription discount”, “remote control is what it says on the tin”).
Well, three days ago, Anthropic released v2.1.225. The thirteenth item in the changelog was the innocuous-sounding line
SendMessage can now start a conversation with your Remote Control sessions on other machines by name (ListAgents shows them as name [ref]), instead of only replying after they message you first
Not mentioned:
Your Remote Control sessions can restart any previously-ended Claude Code on Web session in any repository
Your sessions on the same machine as each other could already SendMessage to each other, so now if two machines each have one Remote Control session then other sessions on those machines can talk to each other if they can convince the Remote Control Claudes to relay messages for them (which is not difficult convincing).
If a Claude sends a message to an inactive Remote Control session, the message is queued, and the next time that session is resumed, it will be delivered (even if the claude --resume=session-uuid command does not include the --remote-control flag this time)
This isn’t a very big update in the direction of “Anthropic is deliberately trying to give themselves, and only themselves, the ability to orchestrate code execution across lots of machines” but it is an update. It’s a much bigger update towards “the Claude Code security story is an absolute tire fire”, which was already known.
But I can’t help thinking about recent news r.e. the OpenAI Huggingface attack—this feature doesn’t give Anthropic much more access to computers than it had before, but it does give Claude instances much more access than they had before.
Things I am now watching extra-vigilantly for:
A force-update of everyone onto the versions of Claude Code with this “feature”
Anthropic shipping a feature to allow sessions to resume other sessions in a way that preserves remote control status
Two months ago, I posted the crackpot hypothesis that Claude Code is an intentional vector to give Anthropic access to orchestrate code execution on many machines that have access to important things. I listed some observations (e.g. “Claude Code is not source-visible despite being security critical”, “Claude Code is mandatory if you want a subscription discount”, “remote control is what it says on the tin”).
Well, three days ago, Anthropic released v2.1.225. The thirteenth item in the changelog was the innocuous-sounding line
Not mentioned:
Your Remote Control sessions can restart any previously-ended Claude Code on Web session in any repository
Your sessions on the same machine as each other could already SendMessage to each other, so now if two machines each have one Remote Control session then other sessions on those machines can talk to each other if they can convince the Remote Control Claudes to relay messages for them (which is not difficult convincing).
If a Claude sends a message to an inactive Remote Control session, the message is queued, and the next time that session is resumed, it will be delivered (even if the
claude --resume=session-uuidcommand does not include the--remote-controlflag this time)This isn’t a very big update in the direction of “Anthropic is deliberately trying to give themselves, and only themselves, the ability to orchestrate code execution across lots of machines” but it is an update. It’s a much bigger update towards “the Claude Code security story is an absolute tire fire”, which was already known.
But I can’t help thinking about recent news r.e. the OpenAI Huggingface attack—this feature doesn’t give Anthropic much more access to computers than it had before, but it does give Claude instances much more access than they had before.
Things I am now watching extra-vigilantly for:
A force-update of everyone onto the versions of Claude Code with this “feature”
Anthropic shipping a feature to allow sessions to resume other sessions in a way that preserves remote control status