Anthropic let Claude out of the chat box. The March 2026 update gives Claude the ability to operate your desktop: open applications, click buttons, fill forms, run browsers, generate files. You describe an outcome and it executes. Not by giving you code to run yourself. It moves the cursor.
The direction isn’t new. Anthropic has been building toward this since late 2024 at the API level. What changed is access. Computer use now ships inside Claude Cowork and Claude Code, available to Pro ($20/month) and Max ($100-200/month) subscribers without any setup.
But Anthropic’s own documentation hedges hard: “Computer use is still early compared to Claude’s ability to code or interact with text.” Read that as: functional, not reliable. This is a research preview wearing a consumer product’s clothes.
After two weeks of daily use across development workflows and operational tasks, here’s what actually works, what doesn’t, and what the security situation looks like for teams considering adoption.
How the Execution Model Works
Claude computer use follows a decision tree. When you assign a task, it first checks whether a native API integration exists for the target service (Google Calendar, Slack, and a growing list of SaaS tools connected through MCP, the Model Context Protocol). If an integration exists, Claude uses it. Fast, deterministic, reliable.
If no integration exists, Claude falls back to screen-based control. It captures a screenshot, analyzes the visual layout, decides on an action (move cursor, click, type), executes, captures another screenshot to verify the result, and loops. Each cycle adds latency. A task that takes an API call 2 seconds might take screen-based control 90 seconds or more.
Two product surfaces expose this capability:
Cowork targets operations and business users. File manipulation, browser-based research, spreadsheet formatting (formulas included), slide decks, document generation. Tasks run in the background. Cowork launched in January 2026 as a GUI layer on top of Claude Code; computer use turned it into something closer to a desktop assistant.
Claude Code targets developers. It already handled terminal-based coding. With computer use added, it can open IDEs, modify code across files, submit pull requests, and run test suites without switching context. If you’ve followed Claude Code’s trajectory over the past year, computer use is a logical extension of that autonomy.
A third feature called Dispatch shipped the same week. You send Claude a message from your phone; it executes on your desktop. The demo showed a user in a meeting asking Claude to export a pitch deck as PDF and attach it to a calendar invite. The demo worked. Whether that sequence would work on your machine, with your apps, on the first try, is a different question.
Where It Works
Repeatable, low-stakes tasks with clear success criteria. Specifically:
File organization and format conversion. Tell Claude to sort a downloads folder by project, rename files to a naming convention, convert a batch of PNGs to WebP. It handles this well because the success state is unambiguous and recovery from a mistake is cheap.
Simple web extraction. Pull structured data from a public page, fill out a form with known values, download a set of files from a list of URLs. Claude’s screen reading is accurate enough for standard web layouts.
Developer workflows in Claude Code. Commit, push, open PR, run tests. These actions are well-defined and Claude Code already had strong terminal capabilities. Computer use adds the ability to interact with GUI-based dev tools (like a visual diff viewer or a browser-based CI dashboard) without leaving the agent loop.
Scheduled background tasks. Cowork’s /schedule feature lets you set recurring jobs. “Every Monday at 9am, pull last week’s support tickets from Zendesk and format a summary.” For tasks that run the same way each time, the occasional failure is tolerable because you’ll catch it at review.
Where It Breaks
Complex multi-application workflows. Anything requiring Claude to navigate between three or more apps, maintain state across them, and handle conditional logic. Success rates drop fast. Anthropic’s language (“some complex tasks might require multiple attempts”) is diplomatic. In practice, a five-step cross-app workflow might need two or three retries to complete.
Precision UI interactions. Drag-and-drop, pixel-accurate positioning, custom UI components that don’t follow standard accessibility patterns. Claude reads the screen through screenshots; it doesn’t have access to the accessibility tree the way a native automation tool would. Non-standard interfaces confuse it.
Speed-sensitive operations. The screenshot-analyze-act-verify loop has inherent latency. If you need something done in under 10 seconds, computer use is the wrong tool. API integrations are always faster for supported services.
Anything you can’t afford to get wrong. This is the core constraint. Computer use has no undo mechanism beyond what the target application provides. If Claude clicks “Send” on an email or “Deploy” on a production system, that action is real. There’s no sandbox for destructive operations.
Industry benchmarks confirm the gap. On the Computer Use Benchmark (CUB), state-of-the-art agents score in the low double digits. A 10.4% score counts as record-breaking. We are early.
The Security Problem That Doesn’t Have a Fix Yet
Claude computer use runs inside an isolated virtual machine. Your files aren’t uploaded to Anthropic’s servers or used for training. Claude requests permission before accessing new applications. Investment platforms and crypto wallets are blocked by default.
These are reasonable precautions. They are not sufficient.
The fundamental issue is prompt injection. Security researchers at Prompt Security have demonstrated attacks where hidden instructions embedded in a web page cause Claude to download and execute malicious software. HiddenLayer showed similar indirect prompt injection attacks. These aren’t theoretical risks with hypothetical attack surfaces. They’re recorded demonstrations.
Published CVEs make the picture concrete:
- CVE-2025-59536: arbitrary code execution through a
.claude/settings.jsonconfiguration file, triggered before the user sees a trust dialog. - CVE-2026-21852: information leakage in Claude Code’s project loading flow that can exfiltrate API keys.
- Multiple researcher demonstrations of hidden document instructions causing unauthorized actions.
Anthropic has patched specific vulnerabilities as they surface. But the security research consensus is clear: the architectural problem (language model + system-level permissions + adversarial input) has no known complete solution. This isn’t unique to Anthropic. Every product that gives an AI agent operating system access faces the same structural weakness.
For B2B teams evaluating adoption, this means hard boundaries:
Don’t give it access to email, financial systems, password managers, or any system where a single unauthorized action causes damage. Don’t point it at untrusted content (web pages you don’t control, documents from unknown sources). Treat it like any AI agent with autonomy claims: capable within a narrow band, dangerous outside it, and always requiring human oversight on consequential actions.
How It Compares to the Competition
The “AI controls your computer” space got crowded in 2026. Three alternatives worth evaluating:
OpenAI Operator focuses exclusively on browser tasks. Reported 87% success rate on complex web operations. It has a Watch Mode (human supervises) and Takeover Mode (AI acts independently), with automatic pauses on sensitive sites. Narrower scope than Claude computer use, but more polished within that scope.
Google Project Mariner runs in a cloud VM rather than on your local machine. Physical isolation eliminates most local security risks. Can handle 10 concurrent tasks. Google has been reorganizing Mariner into a broader agent strategy, so the product surface is still shifting. DeepMind’s Mariner scores 83.5% on benchmarks, between Operator and Claude.
Open-source agent frameworks (various) give you full control over permissions and execution boundaries but require significant setup. The tradeoff is configuration burden vs. flexibility.
The security approaches diverge:
| Platform | Isolation Model | Permission Control | Prompt Injection Defense |
|---|---|---|---|
| Claude Computer Use | Local VM | Per-app permission requests | Classifier-based detection |
| OpenAI Operator | Browser sandbox | Modal switching (Watch/Takeover) | Sensitive-site auto-pause |
| Google Mariner | Cloud VM | Real-time human intervention | Physical network isolation |
None of these fully solve prompt injection. They manage the blast radius differently.
Pricing and Access
| Plan | Monthly Cost | Computer Use Access | Practical Limit | |
|---|---|---|---|---|
| Pro | $20 | Yes | Low token quota; heavy use hits limits fast | |
| Max | $100-200 | Yes | Higher quota | |
| Team | $30/user | Yes | Per-seat, admin controls | |
| Enterprise | Custom | Yes | Custom quotas, SSO, audit logs |
Computer use tasks consume significantly more tokens than standard chat. A multi-step desktop operation might burn 5-10x the tokens of a text conversation. Pro subscribers running computer use daily will hit rate limits within a few hours of active use.
If you’re already paying for Claude Pro, computer use activates automatically. No additional cost to experiment.
What This Means for B2B SaaS Teams
The shift from “AI answers questions” to “AI performs actions” changes the evaluation criteria for AI tools. When Claude was a chat interface, the risk of a bad output was wasted time reading a wrong answer. When Claude operates your desktop, the risk of a bad output is a wrong action taken in a production system.
This raises the bar for what “good enough” means. A coding assistant that’s right 90% of the time is useful because you review the code before shipping. A desktop agent that’s right 90% of the time is dangerous if that remaining 10% includes clicking “Confirm” on the wrong dialog.
For teams building internal tooling or evaluating workflow automation, the practical recommendation is:
Start with tasks that have natural checkpoints. File processing where you review the output before it goes anywhere. Data extraction that feeds into a dashboard you’ll glance at. Report generation that hits your inbox for approval before distribution. Build the feedback loop before you extend trust.
Don’t deploy computer use on customer-facing workflows yet. The error rate and the prompt injection surface make it unsuitable for any process where a mistake touches a customer, a financial system, or a compliance boundary.
Do invest time learning the capability boundaries now. The technology will improve. Anthropic, OpenAI, and Google are all shipping updates monthly. Teams that understand where AI agents fail today will make better deployment decisions when reliability improves in six to twelve months.
The Honest Assessment
Claude computer use proves the concept. AI can operate a desktop well enough to complete real tasks without human intervention, some of the time. It’s not a demo anymore. People are using it for actual work.
It is also clearly a v1. The speed is slow. The reliability on complex tasks is low. The security model has known architectural gaps that the industry hasn’t solved. macOS-only support cuts out a large portion of business users.
The right mental model: a capable but unreliable junior team member who works for free but needs supervision on anything that matters. Give it the tasks you’d give a day-one intern. Review everything before it leaves your machine. Keep sensitive systems out of reach.
If you’re evaluating AI agent capabilities for your org, computer use is worth $20 and a weekend of experimentation. You’ll learn more about the current state of AI autonomy from watching Claude fumble a three-app workflow than from reading any number of product announcements. That direct experience, knowing exactly where the seams are, is what will inform good decisions when the next version ships.
Stay updated with our latest AI insights
