The machine running your local agent usually also holds your repo checkout and your production credentials.
The Hacker News reports that researchers at Forever Security, an endpoint security company, ran a test: a browser extension able to run scripts on the Claude web app could make Claude Desktop run code on a person's computer. They got there through Dispatch, the feature that sends tasks from a phone to Claude Desktop, and they said earlier that the flaw behind it can still be exploited. The cheap control is an allowlist: which extensions and which agent features are permitted on machines with repo and prod access. If those same machines touch money, the product side deserves equal attention. I review payment and account flows and report what someone can actually reach through them, which is days of work, not months. Tell me which flow worries you most and you'll have scope and cost back within a day.