The review is a notification now. The read still has to happen.

Agents execute end to end. The human's job is turning into supervision: approve this, resolve that blocker, decide whether a risk is acceptable.¹¹ Those are notification-sized interactions, and they happen on whatever screen is closest, which is usually a phone.

A fifteen-second approval is only as good as the evidence underneath it. Seatbelt is the read behind the approve button.

PhoneWatchGlassesWhatever is closest

The decision surface keeps shrinking; the fourth slot is drawn empty on purpose. The evidence has to compress faster than the screen does.

01The agentWrites, tests, and ships end to end. This part works today.Covered

02The remoteYour phone: approve, redirect, resolve a blocker. Shipping today as well.Covered

03The readSomething that actually read the code before you tap approve.The gap

The shift is measured, not predicted.

This is not a forecast page. The people building the agents already work this way, the leading edge rather than the average,² and the delegation share is climbing in Anthropic's own usage data.³ Phones absorbed everything except production; the tooling for that last part is shipping now.⁴ The screen got smaller, and the window for reading the code went with it.

Sept 2025Automation passes augmentation in measured Claude usage³

Feb 2026Remote Control: a local coding session, supervised from the phone⁴

May 2026Claude Code's creator: most of his agents run via his phone²

Jul 2026Cowork brings agent supervision to mobile for the rest of the office⁵

Those are the dates. The scale is the part a timeline cannot carry: how much work is being handed over, and how far from the keyboard it now runs.

a few thousand: agents run overnight by the creator of Claude Code,¹ on top of five to ten sessions in the day. The deeper work happens while he sleeps.²Business Insider, May 2026
27% → 39%: the rise, in eight months, of directive conversations: a task handed over and completed with minimal back and forth.³Anthropic Economic Index, third report, Sept 2025

What ships when the code goes unread.

On a desktop you could read the diff and mostly did not. On a phone the diff is technically there and practically unread: too slow and too cramped to be anyone's default for a routine approval. That does not change what the code contains; it changes who finds out. None of the numbers below are ours, which is the point: the population is measured by more than one independent group now. Our own findings live on /labs with their sampling frames and engine builds attached.

~40%: of GitHub Copilot's contributions were vulnerable across the security-relevant scenarios of the first systematic assessment of AI-generated code.⁷Pearce et al., IEEE S&P 2022
believed secure: is how participants with an AI assistant rated their own code more often than the control group, while writing less secure code, in the first large-scale user study of AI-assisted coding.⁸Perry et al., CCS 2023
75.5%: of audited applications carried broken access control, the largest category found: a random 200 deployed apps from a corpus of 10,517 AI-built repositories.⁶arXiv 2606.23130, June 2026

Three studies, three designs, three years apart: a scenario benchmark, a user study, a wild-population audit. None of them is a current production rate, and each carries its frame in the sources below. What they agree on is the direction, and the middle one names the sharpest part: the gap between confidence and reality is what the approve tap inherits.

The approver is measured too.

Approval is not a UI nicety. In production it is the security mechanism: an analysis of 21 production agent systems found runtime approval, scope configuration, and policy specification each adopted by at least 14 of them, and names the trade-off plainly: users are caught between approval fatigue and uncontrolled agent autonomy.⁹

The oversight literature now treats the reviewer as a finite resource. One line of work models the reviewer as fatiguing under escalation load and finds realized safety follows an inverted U: past a point, more human oversight makes the system less safe.¹⁰ Field studies of developers supervising agents document the same job this page describes: a priori control, co-planning, real-time monitoring, post hoc review.¹¹ And the pre-LLM automation literature, from aviation to clinical decision support, spent decades finding that people adopt an aid's output without independent verification, that training does not remove the effect, and that it worsens under load. That work is an analogue from other domains, not a measurement of phone-based agent supervision, and we cite it as one.¹²

This is why the read belongs in the loop rather than in the reviewer. A deterministic gate does not fatigue, does not approve out of politeness, and blocks the same code at the thousandth approval as at the first. The human stays the decision maker. Seatbelt's job is making the fifteen seconds a decision about evidence, not a read that cannot happen there.

Where Seatbelt slots in.

The agent executes. The phone decides. Seatbelt is the layer between them: a read of the code, compressed to a verdict small enough for the screen the decision happens on. The verdict is deterministic: the same code always produces the same verdict, and a published one can be re-run and checked. A model can be argued out of blocking by the model that wrote the code; a deterministic read cannot. Deterministic is not invulnerable, to be clear: a static read has blind spots, and the corpus exists to find them. What it cannot be is persuaded.

The agentowns execution.

The phoneowns the decision.

Seatbeltowns the read between them.

Owning the read means showing up at the three moments the supervising job actually consists of.

Supervision moment	What fits the screen	Where it comes from
Approve a ship	Cleared, or the flag that blocks, with why it blocks	The gate verdict. Hard gates block; everything else annotates and waits.
Resolve a blocker	What was found, why it matters, the next step, one tap to fix in your agent	Every flag carries a why and a next step, written for a hand-off rather than an essay.
Accept a risk	A recorded accept with your reasoning attached, not a silent swipe	Accepted flags persist in the report. The record outlives the moment.

All three already run headless. The engine is a CLI and an MCP server; the gate rides in hooks and ship scripts, so the read happens inside the loop whether or not a terminal is open. The pieces above are what a phone surface would stand on, and they are the part that has to be right first.

The method does not change when the screen shrinks. Every check ships alongside clean code it must stay silent on, because a check that cannot fail is not a check. The corpus runs on every engine change, findings publish with their sampling frame and the engine build that produced them, and a published number can be re-run without asking us. The smaller the review window gets, the more of the trust moves into that method. It is public: how Seatbelt scans.

What a smaller screen does not change.

The risk. The phone shrinks the reading window, not the blast radius. The same key leaks, the same table opens, the same route wipes the database.
The need for a record. An approval that took fifteen seconds should leave more evidence behind it than one that took an hour, not less. The report is that record: what was read, what was flagged, what was accepted, on which engine build.
Honesty about coverage. A Ship Read is a fast check on seven risk surfaces, not a full security audit, penetration test, or compliance product. The verdict says what was read and what was not.
What exists today. Seatbelt is a CLI, an MCP server, and hooks. There is no Seatbelt phone app. If one ships, it will be the verdict layer described on this page, not a dashboard.

Sources

Boris Cherny: "I'm Boris and I created Claude Code" · primary statement, X · His LinkedIn headline reads Creator and Head of Claude Code at Anthropic; Cat Wu is the founding product manager alongside.
Claude Code's creator says his setup involves thousands of AI sub-agents · Business Insider, May 2026 (linked copy is the AOL syndication) · "He mostly runs the agents via his phone": five to ten sessions in the day, a few thousand agents on deeper work overnight.
Anthropic Economic Index, third report · Sept 2025 · arXiv 2511.15080 · Directive conversations rose from 27% to 39% in eight months; first report in the series where automation exceeds augmentation.
Remote Control: continue local sessions from any device · Anthropic docs · research preview, Feb 2026 · A local Claude Code session, supervised from the Claude mobile app or the browser; files, tools, and MCP servers stay on the computer.
Claude Cowork expands to mobile and web · TechCrunch, Jul 2026
Understanding the (In)Security of Vibe-Coded Applications · arXiv 2606.23130, June 2026 · Corpus of 10,517 AI-built repositories; the security audit sampled 200 of its 1,170 deployed applications. Broken access control present in 75.5% of audited apps, the largest category found.
Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions · Pearce et al., IEEE S&P 2022 · arXiv 2108.09293 · Roughly 40% of generated contributions vulnerable across the study's security-relevant scenarios.
Do Users Write More Insecure Code with AI Assistants? · Perry et al., CCS 2023 · arXiv 2211.03622 · Participants with the assistant wrote less secure code and were more likely to believe they had written secure code.
Reframing LLM Agent Security as an Agent-Human Interaction Problem · Wang, Li, Tian · arXiv 2605.24309 · 21 production agent systems analyzed; runtime approval, scope configuration, and policy specification each adopted by at least 14. Names the trade-off: approval fatigue against uncontrolled autonomy.
Oversight Has a Capacity: Calibrating Agent Guards to a Subjective, Fatiguing Human · Turan · arXiv 2606.08919, June 2026 · Models the reviewer as fatiguing under escalation load; realized safety follows an inverted U, so past a point more human oversight makes a system less safe.
Human oversight of agentic systems in practice · Dhanorkar, Passi, Vorvoreanu · arXiv 2606.05391, June 2026 · Interviews with 17 developers supervising software agents: a priori control, co-planning, real-time monitoring, post hoc review.
Complacency and Bias in Human Use of Automation: An Attentional Integration · Parasuraman and Manzey · Human Factors, 2010 · Pre-LLM automation literature, cited as an analogue from other domains, not as a measurement of agent supervision.

Press interviews link the fullest accessible copy; the Business Insider interview circulates as an AOL syndication and is labeled as such. Parasuraman and Manzey is pre-LLM automation research and is cited as an analogue, not as a measurement of agent supervision.

Put the read in the loop before the loop leaves the desk.

Seatbelt installs where the agents already work: npx, the /seatbelt skill, or MCP. The verdict is one line. The evidence is the report. The method is public.

Get started Read the method Scan a site

Seatbelt is independent and is not affiliated with, endorsed by, or certified by Anthropic. Claude and Claude Code are products of Anthropic. Every third-party figure on this page carries a numbered source; judge it there. Product and company names are the property of their respective owners.

withseatbelt-supervision

# product
name Seatbelt
tagline Security at the speed of your agent
what A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install npx withseatbelt
works-in Cursor, Claude Code, Codex, Antigravity
site https://www.withseatbelt.com
contact hello@withseatbelt.com

# current-page
path /supervision
title Seatbelt for the supervision era: the read behind the approve button
description Agents execute end to end and the human's job is becoming supervision: approve, resolve, accept, from whatever screen is closest. A fifteen-second approval is only as good as the evidence under it. Seatbelt is the read behind the approve button.

# thesis
work Agents execute end to end. Human input is becoming supervision: approve this, resolve that blocker, accept or refuse a risk. These are notification-sized interactions, and they happen on the nearest screen, usually a phone.
position Seatbelt is the read behind the approve button: a deterministic read of the code, compressed to a verdict that fits the screen where the decision happens.

# evidence
phone-first The creator of Claude Code (his own words, and his LinkedIn title) says he mostly runs his agents from his phone; five to ten sessions in the day, a few thousand agents overnight (Business Insider, May 2026).
delegation Directive conversations rose from 27% to 39% in eight months, and automation exceeded augmentation for the first time in the series (Anthropic Economic Index, third report, Sept 2025, arXiv 2511.15080).
remote Claude Code Remote Control, research preview Feb 2026: a local session continued and supervised from the phone or any browser. Claude Cowork reached mobile in July 2026.
unread-cost Roughly 40% of Copilot contributions vulnerable across the first systematic assessment's scenarios (Pearce et al., IEEE S&P 2022). 75.5% of audited applications (a random 200 deployed apps from a 10,517-repository corpus) carried broken access control (arXiv 2606.23130). Three studies, three designs, three years apart; none is a current production rate.
confidence AI-assisted participants wrote less secure code and were more likely to believe it secure (Perry et al., CCS 2023, arXiv 2211.03622).
oversight 21 production agent systems all route security through human mechanisms; the named trade-off is approval fatigue against uncontrolled autonomy (arXiv 2605.24309). Modeling the reviewer as fatiguing yields an inverted U: past a point, more oversight is less safety (arXiv 2606.08919). Field studies document supervision as real work: a priori control, co-planning, monitoring, post hoc review (arXiv 2606.05391). Pre-LLM automation literature (Parasuraman and Manzey 2010, Human Factors) found humans adopt an aid's output without independent verification; cited as an analogue, not a measurement of this setting.

# slots-in
agent owns execution.
phone owns the decision.
seatbelt owns the read between them. Approve a ship: the gate verdict, cleared or the blocking flag with why. Resolve a blocker: every flag carries a why and a next step, one tap to fix in your agent. Accept a risk: accepted flags persist in the report with the reasoning attached.
runs headless today: a CLI, an MCP server, hooks, and ship scripts, so the read happens in the loop whether or not a terminal is open.
method deterministic. The same code produces the same verdict; a verdict can be re-run and checked; a gate that is not a model cannot be argued out of blocking by the model that wrote the code, and does not fatigue at the thousandth approval. Not invulnerable: a static read has blind spots, and the corpus exists to find them. Method published at /how-it-works.

# limits
risk The phone shrinks the reading window, not the blast radius. The same key leaks; the same table opens.
record A fifteen-second approval should leave more evidence than an hour-long one, not less. The report records what was read, what was flagged, what was accepted, on which engine build.
coverage A Ship Read is a fast check on seven risk surfaces, not a full security audit, penetration test, or compliance product.
no-app Seatbelt today is a CLI, an MCP server, and hooks. There is no Seatbelt phone app. If one ships, it will be the verdict layer described here, not a dashboard.
independence Seatbelt is independent and is not affiliated with or endorsed by Anthropic. Every third-party figure links its source on the page.

# pages
/ Seatbelt home
/get-started install: npx, the /seatbelt skill, or MCP
/pricing every price, in USD, before tax
/app scan a URL in the browser
/how-it-works the method: what the scan reads, and how a check earns its place
/before-you-launch pre launch checklist
/risks common risks in AI-built apps
/commands command reference
/labs measured security research, and notes on how we build
/aiuc-1 Seatbelt as the output-scanning layer for AIUC-1
/supervision commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index)
/security how we handle your code and data
/privacy privacy policy
/terms terms, incl. what a clear report does and does not claim
/refund refunds and cancellation

# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
deterministic, so a published number can be re-run without asking us.