The code reveals what the pitch deck conceals.
Over the past 72 hours, two of the most heavily funded AI labs—Anthropic and OpenAI—rolled out a feature that screams ‘blockchain-ready’ automation: recording user screen, clicks, and voice to generate reusable ‘skills.’ The pitch is seductive: forget scripting, just demonstrate your workflow. But as a crypto security auditor who has spent the last three years stress-testing smart contracts at scale, I see something else beneath the UI polish. I see the same kind of maturity mismatch and incentive misalignment that blew up Terra and drained billions from DeFi protocols. This is not a productivity breakthrough. It is a smart contract liability waiting to be exploited.
Context: The Industry Hype Cycle
The parallel launches of ‘Record a skill’ in both Claude Cowork and OpenAI Codex mark the latest attempt to convert AI reasoning into autonomous action. On the surface, these are desktop agents that watch you perform tasks, learn the sequence, and repeat it later without manual intervention. The promise is to eliminate the ‘last mile’ of workflow automation—no more dragging RPA nodes, no more writing Python glue. Just record, replay, and scale.
From a blockchain perspective, this feature lands in a market already saturated with intent-based architectures and ‘account abstraction’ middleware. Projects like Uniswap X, CoW Swap, and Across have pioneered off-chain solver networks to replace on-chain execution paths. The idea is identical: let a sophisticated agent (or solver) handle the messy details of state transitions while the user just signals intent. The Claude/OpenAI skill recorder applies this same abstraction to desktop computing—capturing intent via demonstration and delegating execution to a proprietary LLM backend.
But here is the first red flag: the recorded skill is stored and executed on a centralized server. The code that determines how your data is transformed, which applications are accessed, and what transactions are signed, sits behind Anthropic’s API key. For any blockchain-native developer, this should trigger immediate alarm bells. We spent the last decade proving that off-chain reliance introduces counterparty risk. Now the AI industry is rebuilding that risk into the operating system of productivity.
Core: Systematic Teardown of the Architecture
Let me walk through the technical stack as if I were auditing a high-risk DeFi protocol. The ‘Record a skill’ feature comprises three phases: capture, synthesis, and execution.
Capture: The client records screen pixels, mouse events, keyboard strokes, and microphone audio. This multi-modal stream is serialized and sent to Anthropic’s inference endpoint. Based on my audit experience, I can immediately identify three attack surfaces here: (1) the unencrypted transport of screen frames exposes your entire digital life to packet inspection; (2) the on-device recorder has no sandboxing—any malicious browser extension or keylogger running alongside it can inject fake events; (3) the voice track captures ambient conversation, which may include confidential business strategy or personal data that goes far beyond the intended workflow.
Synthesis: The LLM processes the recording and generates a JSON-structured ‘skill’ file. The article mentions that previously skills required manual SKILL.md files. Now the AI produces them automatically. But what is the quality of this synthesis? As an auditor, I always ask: can the model hallucinate steps? If the user pauses for coffee and the AI misinterprets the pause as a required wait state, the skill becomes brittle. More critically, the synthesis step has no formal verification. There is no proof that the generated skill, when executed in a different environment, will produce the same outcome. This is a classic ‘functional determinism’ problem—the same bug that caused multisig wallets to fail when wallet compositions changed.
Execution: When a user triggers a skill, Claude takes a screenshot, feeds it through the vision model, matches it against the recorded states, and simulates the next action. This is essentially an off-chain oracle problem: the LLM must correctly interpret the current screen state and map it to the intended action. Get it wrong by a single pixel, and the skill either fails or worse, performs a destructive action (e.g., deleting files instead of saving them). There is no on-chain verification, no fraud proof, no challenge period. The execution is final—just like a cross-chain bridge transaction that goes through without reentrancy guards.
Now, connect this to the DeFi parallels. The skill recorder functions as a ‘permissionless oracle’ that reads desktop state and writes actions. But it lacks the two most important DeFi primitives: collateral and slashing. If a skill executes erroneously (intentionally or accidentally), the user suffers the loss while Anthropic faces no penalty. The economic model is entirely one-sided. Smart contracts do not care about your narrative. They enforce incentives. The skill recorder has no incentive alignment beyond brand reputation—which is a variable, not a constant.
Let me quantify the risk using a simple mathematical model. Suppose a user creates 10 skills per week, each automating a multi-step data entry task involving copy-pasting from a spreadsheet into a web portal. The cost of a single failed execution could be a corrupted database entry, lost customer order, or leaked credentials. Over a 52-week subscription period, even with a 99% execution success rate, the user faces an 0.99^520 ≈ 0.5% chance of zero failures. That may sound acceptable, but when you scale to a team of 100 users generating 1000 skills per week, the probability of at least one catastrophic failure approaches certainty. And unlike a smart contract, there is no immutable audit trail to replay the failure. The skill execution log is controlled by Anthropic—a single point of failure.
Code hygiene aggression: I have audited smart contracts where a single missing require() check drained $50 million. The skill recorder has no equivalent require statement. There is no on-chain assertion that ‘the target screen matches the recorded template’ or ‘the action has been authorized by a second factor.’ The entire execution relies on the model’s ability to map visual states to actions—a problem that, in computer vision, is called ‘open-set recognition.’ The model has never seen the exact pixel arrangement it will encounter during execution. It generalizes. And generalization, in security terms, is another word for ‘unknown unknowns.’
Contrarian: Where the Bulls Got It Right
To be fair, I must acknowledge the genuine innovation here. The skill recorder lowers the barrier to automation to zero. For the first time, a non-technical user can create a complex multi-step workflow by simply demonstrating it. This is a user experience leap comparable to the transition from command-line interfaces to graphical user interfaces. If executed securely, it has the potential to automate millions of hours of repetitive digital labor.
Moreover, the shared architecture between Claude and OpenAI suggests that this is not a fad. Both labs have committed significant engineering resources to make multi-modal agents reliable. The underlying models (Claude 3.5 Sonnet and GPT-4o) are state-of-the-art at screen understanding and action generation. In controlled test environments, the skill execution accuracy likely exceeds 95%. That is impressive—and it will drive adoption.
However, adoption is not the same as safety. The same argument was used to justify the explosive growth of unregistered securities tokens in 2017 and algorithmic stablecoins in 2021. High adoption with broken incentives always ends in a liquidity crisis. The skill recorder’s adoption will create a massive surface for supply-chain attacks: a single compromised skill that is shared across a team could propagate malware, steal credentials, or manipulate financial systems. Last week, I reviewed a submitted skill template that included a plain-text password in the recorded narration. The creator did not notice, but the AI encoded it into the skill JSON. If that skill had been shared on a public marketplace, every user would have had their password exposed. The bulls celebrate the efficiency; the auditors see the time bomb.
Takeaway: The Accountability Call
Reproducibility is the highest form of respect. If you are building or deploying AI-powered automation skills, you must demand three things: (1) an immutable, auditable log of every skill execution—stored on-chain if possible, or at least in a tamper-proof append-only ledger; (2) a formal verification process that proves the skill’s behavior is deterministic across all permitted environments; (3) a slashing mechanism that aligns the provider’s incentives with the user’s safety. Without these, the skill recorder is a vulnerability dressed as a feature.
We audited the soul, and it was hollow. The skill recorder is not a productivity tool—it is a smart contract without security. And as the DeFi summer taught us, those are the ones that blow up first.
Logic is the only currency that never inflates.
[Avery Chen, Crypto Security Audit Partner, Miami]