Sesame gave its voice agents computers. Voice is now a permissions problem.

Sesame updated its voice assistant on Monday, and the headline is not the voice. It is the computer. Each of Sesame's assistants now gets its own computer: a persistent worker that can use tools, coordinate other agents, and connect to everyday services, starting with several Google apps (Gmail and Calendar, per Sesame's docs). Users can also attach their own MCP servers. Developer tooling for building Sesame apps is planned for later this year. The release is a step toward the company's real bet: AI glasses in 2027, with the assistant as a voice-first OS for the frames.

The demo Sesame wants you to picture: speak hands-free, ask the assistant to plan a trip or research a hobby, get an update when the work is ready. The bolder claim, from the company itself: Sesame's team used its own assistants to develop this release, orchestrating Devin, Claude Code, and Codex by voice while walking, commuting, or sitting at a desk. That is a company claim, not a verified result, and it deserves the label. But take it as the direction of travel even if you discount the demo: voice stops being a readout layer and becomes an orchestration layer, one that can reach the same coding agents your engineers run.

Which makes this a permissions story, not a voice story. An assistant that can speak to Codex inherits everything Codex can touch: your repos, your shell, your cloud credentials, whatever scopes the attached MCPs carry. The failure mode of a voice orchestrator is not a bad transcript. It is an instruction issued in passing, while walking, that the downstream agent executes faithfully. "Clean up the staging environment" is a sentence a human says loosely and an agent executes literally. The casualness of voice is the risk: the interface that makes delegation easiest is the one where intent is specified least.

Sesame ships a few counterweights worth noting. The company says it reduced sycophancy and repetitive phrasing so its characters push back instead of reflexively agreeing, and better memory is coming later this year. Those are character-level mitigations. They are not authority boundaries.

The operator decision: before any voice-driven agent touches production systems, audit the full delegation chain. What tools can the assistant invoke, what can the orchestrated agents do with those tools, and where does a confirmation gate sit between a spoken sentence and an irreversible action. Treat the voice layer like any other privilege escalation path: log the commands it issues to downstream agents, scope the credentials it can reach, and require explicit confirmation for destructive operations. The glasses arrive in 2027. The permission model should be settled before the form factor makes it fashionable. (For the other side of always-on wearables, see our briefing on Norway's proposed AI-glasses ban: regulators are already moving past the blinking-LED theory of consent.)