Using PRIMA Bot Securely
PRIMA Bot opens no way into your Mac from the internet. Anyone who can use your Claude account can still send work to your workspace, so the security of PRIMA Bot rests on that account and on the folder you give it.
How PRIMA Bot Connects
Section titled “How PRIMA Bot Connects”PRIMA Bot keeps Claude Code running in Remote Control server mode. Anthropic’s documentation states that this process makes outgoing HTTPS requests only and never opens an incoming port. It registers with Anthropic’s servers and checks them for work, and no program on your Mac waits for connections from the internet.
Your router treats the connection as an ordinary outgoing web session, which is why setup needs no router or firewall change. Once the Mac has opened the connection, data flows both ways along it, so a photo or file you send from the phone still reaches the Mac.
Where Your Data Goes
Section titled “Where Your Data Goes”| Data | Where it is |
|---|---|
| Your workspace files | On your Mac, where the work runs |
| The parts of a file Claude reads | Sent to Anthropic for processing, as in any Claude conversation |
| The conversation | Saved on your Mac, and stored on Anthropic’s servers while Remote Control is connected |
| Photos and files sent from the phone | Uploaded to Anthropic, then passed to your Mac |
Anthropic’s documentation states that organisations that need Zero Data Retention cannot turn on Remote Control.
What the Design Protects Against
Section titled “What the Design Protects Against”| Risk | Protected | Reason |
|---|---|---|
| A stranger on the internet connects to your Mac | Yes | Nothing listens for connections, so there is nothing to connect to |
| Someone scans your network and finds PRIMA Bot | Yes | It looks like an ordinary HTTPS session to Anthropic |
| Someone signs in to your Claude account and sends work | No | Anthropic delivers their messages to your Mac as if they were yours |
| A harmful file or hidden instruction arrives in a message | No | The file lands on your Mac, and Claude acts on what it reads |
Choosing a Permission Mode
Section titled “Choosing a Permission Mode”The PERMISSION_MODE setting decides how much Claude may do without asking you first.
| Mode | What happens |
|---|---|
default, also accepted as manual |
Claude asks before each file edit or command, and the question appears on your phone |
acceptEdits |
Claude edits files without asking and still asks before it runs a command |
auto |
A second model checks each action in the background and blocks risky ones, so you get far fewer questions |
plan |
Claude reads and plans, and changes nothing |
Start in default mode while you learn how PRIMA Bot behaves. Anthropic’s documentation states that auto mode reduces prompts but does not guarantee safety. Run claude remote-control --help to see every mode your version of Claude Code accepts.
For an Individual
Section titled “For an Individual”Do the following.
- Secure your Claude sign-in. Give the email or Google account behind your Claude login a strong password and two-step verification.
- Turn on Trusted Devices. On Pro and Max plans, turn on Require trusted devices in your Claude account settings. Each phone or browser then needs enrolling before it can see or steer your sessions. Anthropic lists this feature as a beta.
- Back up the workspace on a schedule, with Time Machine or a cloud drive.
- Treat files from other people as untrusted. A supplier’s PDF or a forwarded email can hold hidden text that tries to give Claude instructions, which is known as prompt injection.
- Ask for drafts. Have PRIMA Bot save outgoing messages as drafts, and send anything that leaves the business yourself.
- Keep Claude Code up to date, because Anthropic adds fixes to Remote Control in new versions.
Avoid the following.
- Sharing your Claude login with anyone, family and staff included.
- Keeping passwords, bank details or identity documents in the workspace. Files that PRIMA Bot has no reason to read belong outside the workspace folder.
- Connecting tools you do not need. Every connector you add extends what a message from your phone can reach.
- Leaving PRIMA Bot installed on a Mac someone else now uses, for example after you sell it.
For a Team
Section titled “For a Team”PRIMA Bot belongs to the Claude account that signed in on the Mac. Anthropic’s documentation states that a Remote Control session appears only in that account’s Claude apps and grants no one else access. A Team or Enterprise plan therefore gives each member their own PRIMA Bot.
| Setup | How it works | Watch for |
|---|---|---|
| One PRIMA Bot per person | Each member runs PRIMA Bot on their own Mac with their own seat | Each person reaches only their own files |
| Shared workspace, separate PRIMA Bots | The workspace syncs to each Mac through a cloud drive, and each person runs their own PRIMA Bot | Two people editing one file at the same time can overwrite each other |
| One Mac, separate user accounts | Each person has their own login on the Mac and their own PRIMA Bot | Every user has to stay logged in for their PRIMA Bot to run |
An Owner can turn on Trusted Devices for the whole organisation in the organisation settings. When someone leaves, remove them from the organisation, sign them out everywhere from the admin console, remove their access to any shared folder and take PRIMA Bot off any company Mac they used.
If a Phone or Account Is Compromised
Section titled “If a Phone or Account Is Compromised”- Remove the lost device under Trusted devices in your Claude account settings, which revokes its access at once.
- Change the password on the email or Google account you sign in to Claude with.
- Stop PRIMA Bot at the Mac with the stop command in Everyday Controls.
- Look for files changed since the problem began, and restore them from your backup where needed.
- Start PRIMA Bot again with the start command once the account is secure.
Turning Remote Control Off
Section titled “Turning Remote Control Off”On Team and Enterprise plans, an Owner controls the Remote Control switch for the organisation. Claude Code also has a disableRemoteControl setting that turns the feature off on a Mac completely.