The pane opens on the agent's action. Claude builds, launches or checks an application in Apple's simulator, and the device screen starts streaming beside the conversation [2]. That covers a failure the compiler stays silent about, where interface code builds cleanly and the layout still breaks or a control does nothing [3]. Anthropic's framing is that the agent can compare its implementation against the running application before presenting the work for review [4]. Everything the check needs sits on one machine, because the pane depends on a local Xcode install with the iOS platform present [6].
The security plugin is the half I would test before trusting. Anthropic's release documentation describes a set of agents that map the repository, produce a threat model, hunt for vulnerabilities and then review each other's findings [8]. That is a workflow description with no detection rate and no false-positive rate attached. For the pipeline to be worth its triage cost in your repository, two things have to hold: the architecture map has to resemble the system you think you have, and somebody has to read every finding it emits. Neither is in the notes. The immediately useful knob is scope, since a scan can be pointed at a branch diff, a pull request or a single commit instead of the whole tree [9]. Per-commit is the size that fits inside code review.
Restricting three commands to explicit user invocation is a capability being taken back. Those rarely get shipped [11]. Set beside the review gate on patches, the pattern is consistent: the agent produces candidates, a person promotes them.
The cost of all of this is access. A coding agent that is useful needs permission to read repositories, execute commands and interact with development environments [23]. In a GitHub security advisory published on September 9, 2025, Anthropic described a high-severity flaw in Claude Code releases earlier than 1.0.105, in which a malicious Git user.email value could trigger arbitrary code execution before workspace trust was accepted [15]. On February 25, 2026, Check Point Research said malicious Claude Code project configurations could enable remote code execution and theft of Anthropic API credentials, by way of hooks, MCP servers and repository-controlled environment variables [16]. Those two dates are 169 days apart [20]. Both start in the same place: content the repository supplies being read as configuration. A commit-author field that executes code was on nobody's roadmap.
For scale, OpenAI has described its Codex desktop app as a command center that supports delegating long-running work to multiple agents, and GitHub has said its Copilot coding agent can work asynchronously in the background and return a draft pull request for review [17][18]. Against those, Anthropic's addition is narrow by its own description, a live view into one Apple development tool on supported Macs [19]. In my context that is the better trade. A visual check on one platform that a human starts is a smaller promise than autonomous background work, and it is a promise you can verify by looking at the screen.
