Anthropic’s Claude Learns to Use Your Mac: Powerful AI Agents, Real-World Risks

Anthropic has taken a significant step in the race to build practical AI agents, giving its Claude assistant the ability to directly operate a user’s Mac. For paying customers, Claude is no longer just a chatbot: it can now click, type, open apps, and navigate software on your desktop while you’re away, with tasks dispatched remotely from your phone.

The launch, delivered as a research preview for Claude Pro and Max subscribers on macOS, moves Anthropic squarely into the most competitive front in AI: systems that act inside your tools, not just talk about them. But early tests show a roughly 50% success rate on real workflows, and the company is unusually candid about the security, compliance, and reliability gaps that remain.

What Claude’s new Mac control can actually do

Claude’s “computer use” feature is available today within two Anthropic products: Claude Cowork, the company’s agentic productivity environment, and Claude Code, a developer-focused command-line and coding agent. For now, it’s restricted to macOS and to users on paid Pro plans (starting at $17/month) or higher-cost Max tiers ($100 or $200/month).

Once enabled, Claude can operate the Mac much like a remote human assistant would. It can:

• Open and switch between applications
• Click buttons and UI elements
• Type into fields and forms
• Scroll, navigate, and manipulate files

This capability is built to work with no infrastructure setup beyond installing Anthropic’s app and granting macOS permissions. As Anthropic communications lead Ryan Donegan put it in a press briefing, “Download the app and it uses what’s already on your machine.” There are no API keys or terminal configuration to manage; the tradeoff is that the agent is operating on your live desktop rather than in a sandbox.

The launch is also tightly integrated with Dispatch, a feature that lets users assign tasks to Claude from their phone. Together, computer use plus Dispatch amounts to a remote digital operator that can keep working on your Mac while you’re away from the keyboard.

How Claude decides when to click versus call an API

Anthropic is not letting Claude randomly flail around your desktop. Instead, computer use is guided by a deliberate hierarchy that tries to balance reliability and flexibility.

When given a task, Claude follows a three-level priority system:

1. Direct connectors first. If a dedicated integration exists—for example Gmail, Google Drive, Slack, or Google Calendar—Claude will invoke that connector. According to Anthropic’s documentation, this is the fastest, least error-prone path for operations like reading messages, creating events, or fetching documents.
2. Browser automation second. If no connector is available, Claude falls back to controlling Chrome via Anthropic’s Claude for Chrome browser extension. This lets it navigate web apps with more structure and context than the raw screen.
3. Screen-level interaction as a last resort. Only when neither connectors nor browser automation can accomplish the task does Claude interact directly with the screen: moving the cursor, clicking, typing, scrolling, and opening applications the way a human would.

Anthropic’s own help documentation explains why this matters. Pulling Slack messages through an authenticated connector takes seconds; driving Slack’s UI via screenshots and simulated clicks is slower and more fragile. Screen-level control is the most flexible—because it theoretically works with any app—but it is also the most error-prone.

When using this last tier, Claude relies on repeated screenshots of the desktop to understand context and choose actions. That means anything visible on-screen—personal documents, private chats, financial details—is potentially ingested as part of the interaction. Anthropic says it trains Claude not to engage in activities such as stock trading, entering sensitive data, or collecting facial images, but is explicit that these guardrails “aren’t absolute.”

Dispatch: turning your phone into a remote AI control panel

If computer use is the capability, Dispatch is the orchestration layer that makes it continuously useful. Initially introduced for Cowork and now extended to Claude Code, Dispatch keeps a persistent link between the Claude instance on your Mac and a mobile interface on your phone.

Setup is straightforward: you pair your iPhone with your Mac by scanning a QR code. From that point on, you can message Claude from your phone and have it execute instructions on your desktop, as long as the Mac is awake and the Claude app is running.

Anthropic highlights a range of scenarios, including:

• Checking and summarizing email every morning
• Pulling weekly metrics into an existing report template
• Cleaning and organizing folders such as Downloads
• Compiling competitive analyses from local documents and connected SaaS tools into a formatted file

Crucially, users can schedule recurring jobs—“every morning,” “every Friday”—so that Claude runs workflows automatically without new prompts.

Anthropic’s own blog frames the combination of Dispatch and computer use as a shift in how people interact with their machines: Claude can “use your computer on your behalf while you’re away,” including developer-centric tasks such as making changes in an IDE, running tests, and submitting pull requests.

One early user, Gagan Saluja, described the implications more bluntly on social media: combining Dispatch with scheduling effectively produces “a background worker that can interact with any app on a cron job. that’s not an AI assistant anymore, that’s infrastructure.”

Real-world reliability: a research preview with a 50/50 hit rate

Anthropic labels computer use a “research preview,” and early evidence supports that caveat. In practice, Claude’s performance varies significantly based on task complexity and the number of applications involved.

John Voorhees of MacStories conducted one of the first detailed public evaluations of Dispatch and computer use. In his testing, Claude succeeded at a number of retrieval and summarization tasks, including:

• Finding a specific screenshot on his Mac
• Summarizing the most recent Notion note
• Listing notes created that day
• Adding a URL into Notion
• Summarizing the most recent email
• Recalling a screenshot from earlier in the session

But it failed at several more complex or brittle workflows, such as:

• Opening the Shortcuts app
• Sending a screenshot via iMessage
• Listing unfinished Todoist tasks (due to an authorization error)
• Listing Terminal sessions
• Displaying a food order from an active Safari tab
• Fetching a URL from Safari using AppleScript

Voorhees’ conclusion: Dispatch “can find information on your Mac and works with Connectors, but it’s slow and about a 50/50 shot whether what you try will work.” He judged it “not good enough to rely on when you’re away from your desk,” but still “a step in the right direction.”

Developers working with Claude Code are also surfacing rough edges. One GitHub issue describes the Read tool attempting to process multiple large PDFs in a single turn without checking whether the combined size exceeds the 20MB API limit, causing the whole request to fail. The bug is tagged as macOS-specific, underscoring that Anthropic’s agentic stack is still early in its maturation.

Competitive landscape: OpenClaw, NemoClaw, and the enterprise turf war

Anthropic’s move doesn’t exist in a vacuum. It lands in a market already reshaped by the rapid rise of OpenClaw, an open-source framework that lets AI models autonomously control computers and interact with tools. OpenClaw’s viral adoption earlier this year demonstrated that users and developers are hungry for agents that can take real actions—even if the experience is sometimes rough.

OpenClaw has spawned a broader ecosystem of derivative tools known as “claws,” turning autonomous computer control from a lab curiosity into a crowded product category. Nvidia recently introduced NemoClaw, a framework aimed at simplifying the deployment of OpenClaw with additional security controls, giving enterprises a more structured option atop the open-source layer.

Anthropic is now entering this environment with a tightly integrated, consumer- and enterprise-friendly Mac client. Its bet is that a polished interface, direct connectors, and a subscriber base already paying for Claude will be enough to compete with free and open alternatives.

At the top end of the market, the stakes are increasingly explicit. Reuters has described the current moment as an “enterprise turf war” between Anthropic and OpenAI, with OpenAI reportedly courting private equity firms while emphasizing its own agentic capabilities. In this context, the ability to deploy agents that operate inside existing enterprise software stacks—not just generate text about them—has become a central differentiator.

Security and compliance: prompt injection, screenshots, and missing audit trails

Anthropic’s documentation and messaging are strikingly direct about computer use’s security profile. For Cowork, computer use operates outside the virtual machine environment that normally isolates file operations and commands. Instead, Claude interacts with the user’s live desktop and applications.

That design raises several classes of risk:

• Operational mishaps. A misinterpreted instruction or UI misclick can affect real files, applications, or communications.
• Prompt injection. Malicious content in emails, documents, or web pages could try to hijack the agent’s behavior once it has broad desktop access.
• Privacy exposure. Because Claude works from screenshots, any visible sensitive information may be pulled into the interaction.

Anthropic has layered in multiple safeguards. Claude requests permission before accessing each app. Certain categories—such as investment and cryptocurrency tools—are blocked by default. Users can maintain their own application blocklists. The system scans for signs of prompt injection during sessions, and users retain the ability to halt Claude at any time.

Still, Anthropic is explicit about the limits. Its blog notes that “computer use is still early compared to Claude’s ability to code or interact with text” and warns that Claude “can make mistakes” while threats “are constantly evolving.” Help center guidance goes further, advising users not to use computer use for managing financial accounts, legal documents, medical information, or applications containing other people’s personal data. Anthropic also recommends against using Cowork for workloads subject to regimes such as HIPAA, FedRAMP, or financial services regulations.

From an enterprise governance perspective, the most notable gap is observability. Cowork conversation histories are stored locally on the user’s device rather than on Anthropic’s servers. Enterprise features like audit logs, compliance APIs, and data export do not currently capture Cowork activity. For regulated organizations, that means there is no centralized record of what Claude actually did on a given machine.

One user summarized the concern on social media: when an agent controls the same mouse, keyboard, and screen as a human, “traditional forensic markers won’t distinguish human vs AI actions.” The question of how to build robust audit trails—and how to attribute actions between human and agent—is still unresolved.

User reactions: enthusiasm, anxiety, and practical friction

Initial community response has split along predictable lines: productivity excitement, security anxiety, and platform frustration.

On the positive side, some users reported immediately trying the feature with Dispatch and finding it to be “exactly” what they had been waiting for. Others highlighted the accessibility angle, noting that a native, integrated option is “very exciting for non-tech folks who don’t want or know how to set up OpenClaw.” The pace of Anthropic’s feature rollout drew praise as well, especially from users already embedded in the Claude ecosystem.

Security-focused commentators reacted more cautiously. One user likened giving an AI this degree of control to “letting someone you barely know take the wheel and trusting everything will be fine.” External experts quoted in Engadget coverage echoed the concern that agentic systems can take “major, sometimes dramatic actions quickly and with little warning,” and can be hijacked by malicious actors if defenses fall short.

There are also pragmatic limitations. Windows users are currently locked out of the experiment, given the macOS-only preview. Some Max subscribers complained that Dispatch and computer use consume usage quotas at a rapid clip: one user paying $200/month for a Max 20x plan reported that a single Dispatch prompt used roughly 10% of their monthly allowance. Others pointed back to technical issues like the 20MB payload bug as evidence that the system is not yet ready for heavy, unattended workloads.

Anthropic’s enterprise strategy and the broader tension in agentic AI

The way Anthropic prices and packages these features signals that it sees computer use and Dispatch as part of a broader enterprise play, not just a consumer novelty.

On the individual side, Anthropic notes that agentic tasks “consume more capacity than regular chat” because Claude must coordinate multiple sub-agents and tool calls. Heavy users are pushed toward higher Max tiers. For teams, Cowork starts at $20 per seat per month for groups of 5–75, with custom enterprise pricing that adds administrative controls such as the ability to toggle Cowork organization-wide.

More strategically, Anthropic is building a plugin architecture where domain-specific plugins bundle skills, connectors, and sub-agents into installable packages. Existing examples target legal workflows (contract review and NDA triage), finance (journal entries, reconciliation, variance analysis), and brand voice management. With computer use and Dispatch in the loop, those plugins can in principle span end-to-end workflows across both SaaS tools and local desktops.

Anthropic’s customer testimonials hint at the intended value proposition. One AI automation engineer described connecting Cowork to her company’s tech stack and having Claude identify engineering bottlenecks, returning “an interactive dashboard, team-by-team efficiency analyses, and a prioritized roadmap.” A CTO framed the human role in this world as “validation, refinement, and decision-making. Not repetitive rework.”

All of this plays out against a backdrop of rapid AI adoption and increasing political and regulatory scrutiny. Anthropic’s own economic index, published in March 2026, tracks uneven but accelerating impacts of AI on labor and productivity, particularly in tech, finance, and professional services. At the same time, the company faces questions from policymakers, including recent scrutiny from Senator Elizabeth Warren over defense and supply chain relationships, underscoring that powerful autonomous agents are as much a governance issue as a technical one.

For now, Claude’s computer use remains early and imperfect. It is often slow, screen interaction is less reliable than direct connectors, complex tasks may require retries, and the lack of robust audit trails is a meaningful blocker for some enterprises. Yet Anthropic is intentionally shipping in this unfinished state, betting that users will tolerate a roughly 50% success rate today in exchange for early access to a new class of automation.

The core tension is clear: move fast enough to remain competitive in the agent race, but slowly and carefully enough to avoid dangerous or costly failures on real machines. The industry has spent years proving that AI systems can reason and generate. Anthropic’s Mac control experiment asks a harder question: under what conditions are organizations—and regulators—willing to let those systems act?