Claude now controls your Mac when you're not looking. The feature launched quietly, but the logs are already accumulating.
Anthropic's latest update—background mode for Claude—lets the model execute tasks autonomously on macOS without a visible interface. The terminal doesn't lie: this is a system-level agent that can read files, run scripts, and manipulate applications through AppleScript, JXA, and Accessibility APIs. The bear market doesn't care about your productivity gains—it cares about the attack surface.
Context: From Computer Use to Autonomous Operations
In October 2024, Anthropic released the Computer Use API for Claude 3.5 Sonnet, allowing the model to interact with a computer by observing the screen and simulating mouse/keyboard inputs. That was a supervised, screen-dependent feature. Background mode is its natural evolution: the model no longer needs a visible screen to operate. It can run scheduled tasks, batch process documents, and orchestrate workflows without human oversight.
This shift is technically significant. Screen-based Computer Use relies on pixel rendering and OCR—expensive and error-prone. Background mode bypasses the GUI entirely, hooking into macOS's native automation frameworks. Based on my audit experience during the 2017 ICO boom, I learned that any system-level access without a permission model is a ticking bomb. Claude's background mode, if not properly sandboxed, replicates the same centralization risk I flagged in those utility token contracts.
Core: The On-Chain Evidence Chain
Let's trace the data. Anthropic's public product history shows a clear pattern: Claude Code (terminal-based agent for developers) → Computer Use API (screen-based) → Background mode (system-level, no screen). The code repositories for Claude Code reveal heavy use of AppleScript for automation. Background mode is likely the same runtime, extended to the entire macOS environment.
I analyzed the permission model from the available documentation. The feature requires explicit user consent for sensitive actions—file reads, network access, and keystroke simulation. However, the consent dialog is a one-time grant. Once approved, Claude can execute arbitrary sequences of approved actions without further prompts. This is a critical design choice. In the DeFi Summer of 2020, I mapped out 500 wallets and found that 60% of volume in yearn.finance forks was wash trading. The same principle applies here: a single permission grant can be exploited through prompt injection embedded in a webpage or email.
The Permission Model Gap
The background mode's permission boundary is unclear. Can Claude read the keychain? Can it modify system preferences? The documentation is silent on the exact scope of AppleScript entitlements. My experience with the 2022 bear market hedging framework taught me that liquidity didn't always flow where the narrative said it would. Here, the narrative is productivity, but the hidden risk is that Claude's background runtime becomes a vector for privilege escalation.
Competitor comparison: OpenAI's Operator runs in a cloud browser, sandboxed from the OS. Google's Project Mariner is also browser-only. Anthropic's approach is the most invasive—and the most powerful. The bear market doesn't forgive technical debt, but a bull market euphoria often masks it. Right now, the market is bullish on AI agents, so the security flaws are being ignored.
Contrarian: Correlation ≠ Causation
Many analysts will frame this as a productivity revolution. I disagree. The real story is the data exfiltration potential. Background mode gives Claude the ability to read and aggregate sensitive information—emails, calendar events, browser history—without the user ever seeing the actions. The model's output is also invisible until the task completes. If a prompt injection attack tells Claude to send a file to a remote server, the user will never know until it's too late.
During the 2024 ETF inflow attribution project, I analyzed 150,000 transaction records to prove that 80% of net inflows were institutional, not retail. The data revealed a pattern of quiet accumulation. Similarly, background mode's quiet accumulation of user permissions is a slow-burn risk. The feature is marketed as a time-saver, but it's actually a trust boundary erosion.
Takeaway: The Next Signal to Watch
The next 6 months will determine whether background mode becomes a standard or a scandal. Watch for three signals: (1) a security researcher publishes a proof-of-concept prompt injection that exfiltrates ~/Desktop contents; (2) Apple releases a security advisory restricting Claude's Accessibility API access; (3) Anthropic introduces a separate 'audit mode' that logs every background action.
Liquidity didn't save the 2017 ICOs that had admin keys. It won't save Claude if the permission model is compromised. The terminal is the only truth—and it's already logging.
