Developer flags security risks in phone-to-desktop remote control setups

A developer building an open-source tool called DeepSeek Phone Harness, which allows users to control a desktop AI agent remotely via smartphone over 4G/5G, has outlined key security concerns with such setups. The project uses bearer token authentication, human-approval prompts for risky agent actions, and recommends Tailscale for private network access instead of exposing ports publicly. Unresolved concerns include man-in-the-middle attacks on mobile networks, an agent chaining seemingly harmless steps into harmful outcomes, and the risk of a lost or unlocked phone granting full desktop access. The developer also flagged prompt injection as a threat, where a crafted input could cause the AI agent to execute unintended commands. The post invites the developer community to contribute to an open-source security checklist intended for inclusion in the project's SECURITY.md file.