1. Headline & intro
Letting an AI agent literally grab your mouse and start clicking around your desktop used to be a thought experiment. Anthropic has just turned it into a product feature. Claude Code (and the more general Claude Cowork) can now operate your Mac almost like a remote human assistant: opening apps, browsing, manipulating files, even running dev tools. That sounds incredibly useful—and incredibly dangerous. In this piece, we’ll unpack what Anthropic has actually shipped, why the timing matters, how it fits into the race for “agentic” AI, and why Europe’s regulatory stance may end up shaping how far this trend can go.
2. The news in brief
According to Ars Technica, Anthropic has introduced a new “computer use” capability for its Claude Code developer product and Claude Cowork assistant. For Pro and Max subscribers on macOS, Claude can now see the screen, move the cursor, click, scroll, open files, run tools and navigate the desktop to complete tasks.
Anthropic says the system still prefers using direct integrations (“Connectors”) to services and data sources where possible. When such integrations are missing, the model can request permission to control the local machine and explore what’s on screen. Remote management is also possible via Anthropic’s Dispatch tool, provided the target computer is powered on.
The feature is labelled a research preview. Anthropic warns it is slower and more error-prone than using Connectors, may need retries on complex workflows, and comes with non-trivial security and privacy risks. The company has implemented guardrails, blocked some app categories (like trading and crypto platforms) and trained Claude to avoid certain high‑risk actions, but explicitly concedes these protections are not foolproof.
3. Why this matters
The immediate impact is simple: for developers and power users, Claude can now behave more like a junior colleague with remote desktop access than a chat window that only produces text or code. That changes the ceiling of what AI can actually do for you, not just what it can say.
Who gains?
- Developers and data workers can offload tedious multi-step tasks—setting up environments, running scripts, collecting logs, testing flows in a browser—without building custom integrations.
- Anthropic narrows the feature gap with competitors like OpenAI, Perplexity and others rushing to ship autonomous agents.
- Smaller SaaS tools may incidentally benefit: an agent that can “see and click” reduces the incentive for every startup to ship its own integration.
Who loses or is at risk?
- Security and IT teams inherit a nightmare: an external black-box model with semi-autonomous control over employee machines.
- Users with poor security hygiene—no screen separation, sensitive docs always open—are suddenly exposed to a tool that can see anything visible.
- App ecosystems risk being treated as generic pixels; UX carefully designed for humans may be brittle when driven by an agent that happily misclicks.
Fundamentally, computer-use agents break a long-standing separation: up to now, most consumer AI stayed in the browser or app sandbox. Crossing into the OS layer raises the stakes. Even with protective policies, a misaligned or simply buggy agent can delete the wrong folder, exfiltrate sensitive text from the wrong window, or accept a malicious prompt-injection in a web page.
That’s why Anthropic’s own framing—use it only with apps and data you trust—is telling. This is a powerful capability arriving in an immature state. The strategic bet is that being early in the agent race outweighs the real risk of early incidents.
4. The bigger picture
Claude’s new computer control isn’t launching in isolation; it’s part of a visible pivot in the AI industry from models to agents.
In recent weeks, as Ars Technica notes, Perplexity rolled out its Personal Computer feature, Manus launched My Computer, and Nvidia showed NemoClaw, all promising agents that operate your desktop. Earlier, an open-source project called OpenClaw went viral by demonstrating exactly this kind of OS-level control, enough to get its creator hired by OpenAI to work on “personal agents”.
Two trends intersect here:
- The agentification of AI. We are moving from “chatbot that answers questions” to “worker that does tasks”—writing emails, editing docs, configuring tools, even making purchases. To do that effectively, these systems must escape the browser tab and live closer to the operating system.
- Shadow RPA for consumers. Enterprises have used Robotic Process Automation (RPA) for years—bots that click through SAP or Salesforce like humans. Desktop agents like Claude Code are essentially RPA for individuals and small teams, but powered by large language models instead of brittle scripts.
Historically, whenever software gained the ability to act on behalf of users at OS level, we needed new security models: think of how macro viruses reshaped Office, or how modern browsers evolved fine-grained permission prompts for camera, mic, and clipboard. We’re at a similar inflection point for AI.
Compared with competitors, Anthropic leans heavily on its “constitutional AI” safety branding. But from a capability standpoint, everyone is converging on the same idea: an always-on agent that sees your screen, reads your documents, manipulates apps and coordinates cloud resources. The winner won’t just be whoever has the smartest model; it will be whoever ships the safest, most understandable control plane for that power.
5. The European / regional angle
For European users and companies, Claude’s desktop control arrives into a very different regulatory climate than in the US.
The EU AI Act introduces risk-based categories; agents that can move money, manipulate critical systems or process biometric data will likely fall into high‑risk or prohibited territory without strict safeguards. Even in this “research preview”, Anthropic’s decision to block categories like trading platforms sounds partly like a pre‑emptive answer to such concerns.
GDPR adds another layer: the moment Claude can see your whole screen, it can in principle access any personal data visible—customer records in a CRM, HR files, even medical information. If this data is transmitted to Anthropic’s servers, companies become joint stewards of that processing. Data protection officers in Germany, France or the Netherlands will ask uncomfortable questions long before mass deployment.
This creates opportunity for European-native alternatives. Startups in Berlin, Paris, Ljubljana or Stockholm could offer on‑device or EU-cloud‑only agents with strong auditing and data residency guarantees, tailored to local regulation. For example, a Slovenian SME might prefer an agent that runs on local hardware and integrates with national e‑ID infrastructure, rather than a US-based black box.
Culturally, European users tend to be more privacy-conscious. That does not mean agents will fail here, but adoption will likely skew toward enterprise pilots with tight scopes, rather than free‑for‑all consumer usage. Expect banks, insurers and public-sector IT in the DACH region to demand detailed logs of every click and keystroke the agent performs.
6. Looking ahead
Where does this go in the next 12–24 months?
- From research preview to product: If Anthropic sees strong uptake among developers, expect a Windows client, deeper integration with IDEs, and enterprise controls (policy-based restrictions, audit logs, role-based access). Mac-only is a testing ground, not the endgame.
- OS vendors respond: Microsoft is already pushing Copilot+ PCs with NPU acceleration and tighter AI integration into Windows. Apple is under pressure to reveal its own agent story in macOS and iOS. Both have an incentive to bake agent permissions into the OS: think “this AI can see only this app and these folders”, enforced at system level.
- New attack surface, new failures: Prompt-injection attacks hidden in web pages, fake UI elements designed to trick agents, or simply destructive misclicks will be reported. The first high-profile “AI agent deleted my company’s data” story will trigger calls for stricter guardrails and probably litigation.
- Norms and UX for autonomy: Right now, the mental model is fuzzy: is Claude my assistant, my intern, or my co-pilot? Over time, we’ll likely see clearer modes—observe-only, suggest-only, and fully autonomous—with visible status indicators and easy emergency stop.
For readers, the key questions over the next year:
- Does your OS start offering built-in agent controls?
- Do enterprise policies explicitly address AI desktop agents?
- Does a European vendor emerge with a credible, privacy‑preserving alternative?
7. The bottom line
Claude Code’s new desktop-control powers mark the real start of OS‑level AI agents for mainstream users. The upside in productivity is huge, but so is the blast radius when something goes wrong. Right now, this should be treated as an experimental tool for non‑sensitive workflows, not a trusted operator of your digital life. The deeper question for all of us: how much of our computer are we truly willing to hand over to a probabilistic system—and what new norms, laws and designs will we demand before we do?
