Remote Control, Stricter by Default
Connect a chat channel to Arbiter and two-factor approval is on before you touch a setting. Acting from your phone, including asking a session for a plan, needs a code, an approval binds to the one request that asked for it, and wrong guesses run out fast.
Earlier posts here described remote control behind a second factor: reading stays inside your own bot channel, and anything that acts needs a single-use code from your authenticator. A protection like that is only as good as what someone gets without reading the manual. With a first public pre-release in preparation, the remote path got a pass against exactly that question: what does someone get if they install Arbiter, connect their phone, and never open the settings page?
They now get the strict version.
On from the moment a channel is connected
Once you connect Telegram, Signal or WhatsApp, two-factor approval is on unless you deliberately switch it off, and it stays on when related approval settings are spelled out in your configuration. Until an authenticator is enrolled, anything that would act from the phone is refused rather than waved through. Reading still works, and so does the desktop app on the machine itself, so the worst a fresh install does is ask you to enroll before your phone can launch work.
Asking for a plan now counts as acting
Every chat command is classified as either reading or acting, and a command without a classification is refused outright, so nothing new can slip in between the two. Reading covers status, the list of live sessions, remaining capacity, and a session’s recent output. Acting covers anything that runs code or sends a prompt to Claude Code or Codex.
That second line moved one command. Asking a session for a plan used to be free from the phone, and earlier posts here said so. A plan still sends a real agent to read your machine and report back, so it now asks for your code like any other action. In practice the cost is small: a valid code opens a short window for that one conversation, so a run of related steps does not mean a run of codes.
An approval answers one request
An approval is now bound to the specific request that asked for it. A reply that arrives before the request exists, or one aimed at a request that has already closed, is refused, so nothing can be approved in advance. A turn you started at your desk can be denied from your phone, but it can only be approved back at the desk.
Wrong codes run out
A six-digit code is only as strong as the number of guesses it allows. More than five wrong codes inside fifteen minutes lock that chat account out of approvals for fifteen minutes, and each further lockout doubles, up to a day. A correct code resets the count.
The settings that guard the gate
Once an authenticator is enrolled, changing who may drive the machine, what it runs, or where its secrets go needs a current code as well. Wrong codes there are counted separately, so a burst of bad guesses at the settings cannot lock your phone out of approving real work.
A few quieter defaults moved the same way. Adding a project lists the MCP servers it declares and starts none of them, and a server runs only while its command still matches the one you confirmed. The optional HTTP control plane stays off unless you enable it, refuses a key shorter than sixteen characters, and will not listen beyond this machine without TLS. Secrets are never shown back by the app or the command line, and the coding agents Arbiter launches do not inherit Arbiter’s own channel tokens or keys.
Still your fleet, under your own logins
None of this changes what remote control is for: you, driving your own sessions on your own machine, under your own accounts. What changed is how much of the careful configuration arrives on its own: more of it is now simply what anyone who connects a phone gets. The rest of the remote path, from driving a session by id to the stop-all control, is laid out in Take the wheel of your own agent sessions.
Arbiter is a proprietary working alpha in public binary release preparation. Follow the public release channel or RSS feed for updates.
Was this useful?