IMPLICATOR
Anthropic on Monday launched a research-preview feature that lets Claude directly control a Mac's mouse, keyboard, and screen to complete tasks through both Claude Cowork and Claude Code, the company said. The "computer use" capability is available for Claude Pro and Max subscribers on macOS, with Claude falling back to raw screen interaction only when its built-in app connectors cannot handle a job. The release follows Anthropic's February 25 acquisition of Vercept AI, a desktop-automation startup, and extends the company's push into AI agents as the category heats up around the viral OpenClaw framework.
In Cowork, Claude's approach works through a three-tier fallback. It first reaches for direct connectors to services like Slack, Google Calendar, and Gmail. If no connector exists, it opens Chrome and works through the browser. Only when both options fail does it grab the screen itself, clicking buttons, typing into fields, opening files. Claude Code Desktop follows a similar hierarchy but adds Bash as an intermediate step. Anthropic said Claude "prioritises the fastest method," and that direct integrations produce fewer errors than screen-based control.
What Changed
- Claude can now control Mac mouse, keyboard, and screen via Cowork and Code for Pro/Max subscribers ($20-200/month)
- Feature built on Vercept AI acquisition announced Feb 25; team shipped in under four weeks
- OSWorld benchmark jumped from under 15% to 72.5%, which Anthropic calls 'approaching human-level'
- Financial and trading apps blocked by default; Claude sees everything on screen via screenshots
How Vercept shipped in four weeks
The acquisition produced a shipping product in under a month. Anthropic announced the Vercept deal on February 25. By Monday, the feature was live. Vercept co-founder Kiana Ehsani posted the timeline on X. Four weeks from deal to a live product.
"Everyone moves fast, everyone is incredibly smart, humble and supportive, and it's really easy to get things done," Ehsani wrote. She credited the people, not the models, for Anthropic's speed.
That speed matters because the pressure from outside is enormous. Jensen Huang told CNBC last week that OpenClaw is "definitely the next ChatGPT" as every major AI lab scrambles to match what a solo Austrian developer built. OpenClaw now has more than 300,000 GitHub stars. Users message the agent through WhatsApp, Telegram, or iMessage and have it perform real work on their machines. OpenAI hired Peter Steinberger, OpenClaw's creator, last month to "drive the next generation of personal agents." Nvidia shipped NemoClaw, an enterprise-grade wrapper around the open-source project, last week.
Anthropic had been building toward this since January, when it launched Cowork, a desktop product for knowledge workers that gave Claude access to local files and a sandboxed execution environment. Computer use adds what Cowork lacked: direct interaction with any application on the screen, including tools that have no API.
The company also released benchmark figures alongside the Vercept acquisition announcement. Anthropic said its models scored under 15 percent on OSWorld, the industry standard for measuring how well AI completes real desktop tasks, in late 2024. That number has reached 72.5 percent. Anthropic described the improvement as "approaching human-level performance" on tasks like spreadsheet work and form completion.
Two model upgrades preceded the launch. Anthropic shipped Claude Opus 4.6 on February 5 and Claude Sonnet 4.6 on February 17. The company said both models improved coding, long-horizon planning, and computer-use performance. The Vercept acquisition gave the company a team that knew how to turn those model improvements into a product.
The safety lab's uncomfortable product
An obvious tension runs through this release. In February, Anthropic reportedly clashed with federal agencies over contractual restrictions on using Claude for surveillance and weapons applications, according to multiple news outlets. The same company is now handing its AI the ability to control users' entire desktops.
The company sounds defensive about the contradiction. It points to what it calls a "permission-first approach." Claude requests access before touching each new application. Users can stop operations at any point. Financial and trading platforms are blocked by default. Automated scanning checks for prompt injection attempts, a common attack vector when AI systems get computer access.
But the caveats keep coming. "Computer use is still early compared to Claude's ability to code or interact with text," the company acknowledged. It recommends avoiding sensitive data entirely during the preview period. Complex tasks may require multiple attempts. Screen-based control runs slower than direct integrations. Some apps are disabled by default because Anthropic considers them too risky.
And then there is the screenshot problem. Claude relies on screen captures to understand what it is looking at. Whatever is visible on the display, including personal data from other applications running in the background, Claude can see. Anthropic tells users to close confidential files before turning the feature on. That is the entire mitigation.
That puts the burden on users to sanitize their own desktops before handing over control. In practice, not everyone will bother. The people most likely to adopt a research preview are the ones least likely to worry about edge cases.
What the agent security record already shows
The security concerns here are not hypothetical. The AI agent wave that followed OpenClaw has already produced real failures at real scale.
In January, security researchers reported finding 1,862 Moltbot servers exposed without authentication, with credentials stored in plaintext and no access controls of any kind. Moltbot was a consumer AI agent running on real people's machines with access to real data. The exposure was total.
Stay ahead of the curve
Strategic AI news from San Francisco. No hype, no "AI will change everything" throat clearing. Just what moved, who won, and why it matters. Daily at 6am PST.
No spam. Unsubscribe anytime.
OpenClaw itself runs locally on a user's device, touching files, credentials, and system resources. Home lab setups powering many OpenClaw installations have expanded the attack surface to thousands of always-on machines with minimal security oversight. Nvidia's NemoClaw added guardrails on top, but the core vulnerability persists: any AI agent with desktop access becomes a target for prompt injection, data theft, and session hijacking.
Anthropic is betting that its permission model and injection scanning will hold where open-source alternatives have failed. That bet will play out in real time, on real machines, with real user data. The company admits the threat environment is "constantly evolving." Constantly evolving threats versus a feature that just shipped. Not exactly a comfortable margin.
Your phone becomes the remote control
Computer use pairs with Dispatch, a mobile tool Anthropic released last week. Dispatch creates a persistent conversation between your phone and a desktop Claude session. Send a message from the train asking Claude to export a pitch deck as a PDF and attach it to a calendar invite. Walk away. Come back to finished work.
A video posted Monday to X showed the workflow in action. Claude found a contract in Finder and exported it to PDF. Attached it to a calendar invite. Then it jumped to a terminal, spun up a dev server, and grabbed some browser screenshots without being asked. The clip spread fast.
For developers, the update extends what Claude Code already handles. Claude can now make changes inside an IDE, submit pull requests, run tests, and report progress in real time, across any application, not just tools with built-in integrations. That turns a coding assistant into something closer to a junior colleague who happens to live inside your Mac.
Use cases from the announcement paint a picture of the target user. Compile a competitive analysis from local files and connected tools. Open a phone simulator to test an app for UX issues. Build a formatted spreadsheet from multiple data sources. The common thread is work that normally requires a human sitting at a desk, clicking through applications one at a time.
Availability is limited. Pro plans cost $20 per month. Max runs between $100 and $200 per month. Team and Enterprise tiers are excluded for now, which means the companies most likely to care about desktop automation, large organizations with compliance requirements, cannot use it yet. macOS only. The Mac must stay powered on with the Claude desktop app running.
Three companies, three bets on how agents should work
Monday's launch sharpens a split in how the major AI companies think about giving models control of computers.
Google initially took the narrowest path. Its Gemini 2.5 browser-based agent feature, released in October, handled only web tasks. Google has since expanded. Gemini 3 Pro and Flash now support built-in computer use, but Google's documentation still emphasizes browser-first workflows. If you need full desktop control, Google is not there yet.
OpenAI acquired Sky, a Mac desktop assistant that could understand what was on screen and take action in apps, in October 2025. OpenAI has since pursued broader agent capabilities, but as The Decoder noted, browser-only features "haven't been reliable enough to gain real traction." Desktop-level control from OpenAI remains in development.
Emboldened by the Vercept acquisition speed, Anthropic is taking the widest swing. Full desktop control. Mouse, keyboard, screen, local files, installed applications. The ambition is the largest, and so is the attack surface. Meta acquired Manus, an autonomous agent startup, in December, folding the team into its broader AI efforts.
Perplexity is pursuing a different model altogether. Its Perplexity Computer tool launched last month as a cloud-based agent, and a local version called Personal Computer runs on a dedicated device such as a Mac mini. Access is currently limited through a waitlist.
Behind every one of these products sits OpenClaw, the project that accelerated agent timelines across the industry. Steinberger built what billion-dollar companies are now scrambling to replicate. OpenAI hired him. Nvidia packaged his work for enterprise customers. Anthropic acquired a separate team, pointed it at the same problem, and shipped the result in under a month.
Computer use is a research preview, and Anthropic is treating it that way. The company says it will collect data from early users before deciding what to expand and what to pull back. Windows and Linux support are planned but carry no public timeline. For now, Claude controls your Mac. What else might try to reach it through Claude is the question Anthropic has left its users to sort out on their own.
Frequently Asked Questions
What can Claude actually do on my Mac?
Claude can open apps, work through Chrome, fill spreadsheets, export files, run dev tools, and submit pull requests. It tries app connectors first (Slack, Gmail, Calendar), then browser, then direct screen control as a last resort. Financial and trading platforms are blocked by default.
How much does Claude computer use cost?
It requires a Claude Pro plan at $20 per month or Claude Max at $100 to $200 per month. Team and Enterprise tiers are excluded for now. The feature is currently macOS only and requires the Claude desktop app running on a powered-on Mac.
What is Vercept AI and why does it matter?
Vercept AI was a startup focused on AI-powered computer control that Anthropic acquired on February 25, 2026. The team shipped computer use as a live product in under four weeks. Anthropic credited the acquisition with improving its OSWorld desktop-task benchmark from under 15% to 72.5%.
What security risks come with giving Claude desktop access?
Claude takes screenshots to understand the screen, so it sees everything visible, including data from other open apps. Prompt injection is a known attack vector. Security researchers found 1,862 Moltbot servers exposed earlier this year, showing what can go wrong with consumer AI agents that get desktop access.
How does this compare to Google and OpenAI agent features?
Google's Gemini emphasizes browser-first workflows, though Gemini 3 added broader computer use support. OpenAI acquired Mac assistant Sky but has not shipped full desktop control yet. Anthropic is the first major lab to offer direct mouse, keyboard, and screen access on the desktop.
Harkaram Grewal
Freelance correspondent reporting on the India-U.S.-Europe AI corridor and how AI models, capital, and policy decisions move across borders. Covers enterprise adoption, supply chains, and AI infrastructure deployment. Based in New Delhi.
