Last week two of the biggest AI labs shipped models that do the same new thing. They operate your computer.

Meta released Muse Spark 1.1 on July 9. It works across desktop, browser, and mobile, decides on its own when to write a script and when to just click through an interface, and holds context across a long session while it moves between applications. Two days earlier, Anthropic pushed Claude Cowork to phone and web, where it runs tasks in the background even when your laptop is closed. Anthropic published usage data from 1.2 million sessions alongside it. The single largest category, at a third of all use, was business operations. One of the named examples was “reconciling quarterly spending.”

Sit with that phrase for a second. Not “summarize this document.” Reconciling quarterly spending. That is a controls task, and an agent is already doing it for a lot of people.

The shift is subtle and it matters

For the last two years, the agents we worried about talked to systems through APIs. They had a service account, an API key, a defined set of endpoints they could hit. When I wrote a few weeks ago that you should ask for a list of every AI agent in your systems, that was the world I had in mind. Non-human identities you can, in principle, enumerate and log.

Computer-use agents are different in one specific way. They do not call the API. They drive the screen. They move the mouse, fill the field, click submit, inside a session that a human is logged into. To the application underneath, the actions look like they came from the person whose credentials opened the session.

That is a genuinely new problem, and it is not a security problem first. It is an evidence problem, which makes it ours.

Your two oldest questions just got harder

Internal audit has always tested two things: who has access, and who did what. Computer-use agents complicate both, and they do it from a direction our controls were not built to watch.

Access first. An agent operating through the UI does not need its own provisioned account. It borrows a human’s. Your access review can be perfect, every entitlement correct, every leaver removed, and it tells you nothing about the fact that a model is now taking actions inside three of those accounts. The control is looking at the badge on the door. The agent walked in wearing someone else’s badge.

Now the audit trail. This is the part that should bother you. When a computer-use agent posts a journal entry through the finance system’s front end, the log records the logged-in user. There is no field for “a model did this.” The transaction looks hand-keyed. Segregation of duties, the control we lean on hardest in finance, assumes the person who can create and the person who can approve are two different humans exercising judgment. If one human is running an agent that does both steps while they get coffee, the segregation is intact on paper and gone in reality.

We spent decades making sure the record shows who did what. The record still shows a who. It is just no longer reliably a human, and nothing in the log tells you which.

This is not a reason to panic. It is a reason to scope.

I want to be careful here, because the easy move is to turn this into a scare piece, and that helps no one. Some of this work is genuinely useful. I run an audit orchestrator myself, and the whole point is that it does real work against real systems. I am not arguing agents should stay out of your applications. I am arguing that when they come in through the front door of a human session, you need a way to know they were there.

The honest position is that most organizations cannot know that yet. The tooling to distinguish an agent-driven session from a human one is early. But the audit response does not depend on perfect tooling. It depends on asking the questions that surface the gap, which is the thing we are actually good at.

The frameworks are catching up, slowly. COSO put out guidance this year on internal control over generative AI, and it asks for the things you would expect: model documentation, change logs, records of human override. ISACA has moved its IT audit framework to a fifth edition that folds in AI-specific guidance. And the IIA has a public consultation on AI risk coverage open right now, closing July 23. If you have a view on how this profession should treat agents that act inside human sessions, that consultation is a place to put it. Better we shape the standard than inherit one written by people who have never run an access review.

What I would actually do this quarter

I am wary of checklists, because the real work is judgment. But if I were scoping this into a plan right now, I would start narrow and concrete.

  • Ask which business processes already have computer-use agents touching them. Not API integrations. Agents operating an application through its interface. If nobody can answer, that gap is your first finding.
  • Test whether the log can tell a human action from an agent action. Pick one high-risk system, finance or procurement, and ask to see how an agent-driven transaction is recorded. If it is indistinguishable from a keystroke, your evidence base for that system has a hole in it.
  • Re-examine segregation of duties on the assumption that one human plus one agent can be two actors. The classic create-and-approve conflict changes shape when a single person can run both steps through a model. Ask whether any approval control now rests on a separation that an agent quietly collapses.
  • Make a named human owner a precondition for any agent that operates a real system. Same principle I keep coming back to. If the answer to “who is accountable for what this agent did” is the model, that is not an answer.

None of this asks you to become a machine learning engineer. It asks you to take the two questions you have been asking your whole career and point them at an actor that now wears a person’s face when it logs in.

Here is the one I would sit with over the weekend. If an agent posted a transaction in your organization today, through someone’s logged-in session, would anything in your evidence tell you it was not that person? If the answer is no, that is not a hypothetical exposure. It is the state of your audit trail as of this week.

If you are working out how to see agents inside human sessions in your own function, I would like to hear how you are approaching it. Get in touch.

Sources and further reading: