Agents got hands this week. Your controls didn't.

Anthropic released Claude Computer Use on macOS this week. It moves the cursor, reads the screen, clicks through Slack and Google Workspace, tries native connectors first and falls back to raw UI automation when they aren't there. A companion tool called Dispatch lets a user text a task from their phone and have Claude execute it on their desktop. Anthropic's own release notes warn, in plain English, that prompt injection can hijack the whole thing and advise against pointing it at sensitive data.

That is the story of the day, and every other thread on the board reinforces it.

The threat model just changed under you

For a decade the working assumption has been: software reads data, humans take actions, and the boundary between the two is where you put your controls. Computer Use erases that boundary in a shipping product. A poisoned document, a crafted email, a Slack message with adversarial content — any of these can now redirect an agent that is holding the user's session, the user's SSO cookies, and the user's permissions. The exfiltration path is a legitimate mouse click.

Your EDR was not built to flag programmatic cursor movement inside a signed Claude process as suspicious. Your DLP was not built to inspect "the user pasted this into Gmail" when the user is an LLM. Dispatch is worse: it's a phone-to-desktop control channel that lives outside your MDM, VPN, and conditional access policies by design. A compromised phone is now hands-on-keyboard on the workstation.

Map it to ATT&CK if you need the vocabulary — T1059 via UI automation, T1071 through the app itself, T1041 through Dispatch, T1204 for the user who clicked Allow once. The techniques aren't new. The delivery mechanism is a $20/month consumer subscription your employees have already bought.

Yes, but — Anthropic did the responsible thing by publishing the warning, and this is a research preview with limited blast radius today. Fine. It doesn't matter. Microsoft's own data puts 62% of UK enterprises already running AI agents and 84% of security leaders flagging shadow agents they can't see. The adoption curve is not waiting for your policy review. ByteDance's DeerFlow 2.0 — bash terminal in Docker, persistent cross-session memory, autonomous sub-agent spawning — hit #1 on GitHub Trending the same week. Developers are cloning it now.

The vendor safety story got worse in the same week

Sam Altman stepped back from direct oversight of OpenAI's safety and security teams to focus on the launch of a frontier model codenamed Spud. OpenAI killed Sora and walked away from a $1B Disney partnership signed three months earlier to free up compute for it. A federal judge just reversed a Trump-administration designation of Anthropic as a "supply chain risk" — the designation lost, but the precedent that an AI vendor can be politically switched off overnight is now sitting on the shelf.

Meanwhile Anthropic reportedly went from $1B to $20B ARR in fourteen months, with the steepest acceleration after Opus 4.6 shipped agentic tool use. Read those numbers together with the safety news and the pattern is clean: capability is the revenue driver, safety is the cost line, and both frontier labs are pre-IPO. Safety is a variable cost right now, and it's being cut.

Which means the implicit trust model — "the vendor has a safety team, so the model is roughly safe" — is no longer load-bearing. Your application-layer guardrails have to work independently of whatever Anthropic or OpenAI does to their internal review process this quarter.

Pinterest published the only real answer

Pinterest's production MCP platform is the first credible enterprise reference architecture for governing agent tool access. Four components: a central registry where tools require explicit approval before agents can call them, layered authentication that carries the user's JWT alongside a separate service identity, shared deployment paths so agent tooling ships through the same infrastructure as everything else, and IDE/chat integration so engineers discover governed tools where they already work.

The non-obvious piece is the dual identity. Agents act on behalf of users but with their own service-level access. Without that separation you cannot distinguish a user's legitimate request from an agent's autonomous lateral movement — and every downstream audit log is meaningless. Alibaba's FinMCP-Bench (613 samples) confirms the failure mode you're governing against: LLMs handle single-tool calls fine and fall apart on multi-tool dependency chains, which is exactly the production case.

If you are shipping any agent infrastructure this quarter, Pinterest's design is the floor, not the ceiling.

What to do this week

One thing, specific. Stand up an agent inventory before you stand up an agent policy. Pull Claude Pro/Max license data from your SSO provider and cross-reference it against your macOS fleet. Query your endpoint telemetry for the Claude desktop app and for the Dispatch companion. Grep your monorepos for deerflow, mcp, computer-use, and the top ten open agent frameworks. Ask your top five engineering managers, in writing, what agents their teams are running against production systems.

You will find more than you expect. That number — the count of agents currently touching corporate data that your security team did not scope — is the only metric that matters right now. Everything else, from Pinterest-style governance to prompt-injection mitigations to red-teaming Spud when it drops, is downstream of knowing the denominator.

Get the denominator by Friday.