Take the wheel of your own agent sessions, from anywhere, behind a second factor

Remote control of an AI operation is easy to demo and hard to make safe. Showing a plan on a phone screen is the easy half. The moment that actually matters is the one where something you approve from a distance starts running code on your machine. Get that moment wrong and remote control is a liability. Get it right and you can run your operation from anywhere without leaving the safety back at the desk. Arbiter is built for the hard half.

Reading stays in your channel; acting needs a code

Start with the part most tools blur: nothing here is public. Everything reaches Arbiter through your own bot channel, so only your allowlisted account can talk to it at all, and a sender who is not on the list is simply ignored. That bot-channel gate is the same first factor the rest of the industry already runs on. Inside that channel, reading what a session is doing, listing what is running, or having the brain draft a plan carries no extra friction, because it touches nothing and changes nothing. Acting is where Arbiter goes a step further. The instant an instruction would run code or edit your files, it stops and asks for a single-use second factor. The friction lands precisely on the doing, and nowhere on the looking.

Drive a session by id, not a window

From a configured chat channel you can point at one of your live sessions by its id and drive it directly. Ask for a plan and it comes back read-only, with no code needed. When you are ready to let it act, you send the work and it runs on the session it already has, with all the context that session already built, no fresh window and no lost history. This reaches the agents you actually use. Claude Code and Codex are driven through the same path, so you are not learning a different remote for each.

Running code is the line, so the lock sits on the line

Anything that executes waits for a single-use, time-based code, the kind any standard authenticator app produces. One code clears one conversation for a short window, and the same gate stands no matter which surface the request came from, so there is no side door around it. The secret that generates those codes never leaves your authenticator. It is never held by Arbiter’s model and never sits in its context, so even a prompt that tried to talk the system into surrendering its own credentials would find nothing there to give up. Turning the gate off, or enrolling a new device, itself needs a current code, so stealing the chat account does not steal the control.

It is your fleet, under your own accounts

This is worth stating plainly, because remote control of sessions that run code deserves a clear conscience. Everything here is you driving your own agents, on your own machine, under your own subscriptions. Arbiter spawns each session as the official first-party client under your own login. It does not read or inject your credentials. Access is deny-by-default: a sender who is not on your allow list is simply ignored. And a stop-all control is always within reach, so if anything looks wrong you halt the whole operation first and ask questions after. This is a tool for reaching your own fleet from the far side of the city, not for reaching anyone else’s.

The honest version of remote control

Reading a plan from your phone was always going to be easy. Approving execution from your phone, with a real second factor standing between the plan and the doing, and the key kept somewhere the software cannot be tricked into surrendering, is the version worth shipping. The freshly upgraded local brain steering it all keeps the reasoning on your hardware while you are away from it. Supervision should extend your reach, not widen the circle of who can see your work.

Arbiter is a proprietary working alpha in public binary release preparation. Follow the public release channel or RSS feed for updates.