Contents

Dispatch is the feature where you send an instruction from your phone and Claude carries the work out on your own computer. In the official words, "you can message Claude from your phone and have it work on your desktop computer" (Assign tasks from anywhere in Claude Cowork). It does not run in the cloud. Your actual machine moves.

That is the fork in the road for any assessment of it. The size of what it can do and the size of the danger come out of the same single fact. Because it can reach your local files, your connected services, your installed apps and the screen itself, "it is done by the time you get home" becomes possible — and for exactly the same reason, an accident here is a real one.

⚠️ This danger is not me being dramatic. Anthropic writes it into its own help pages: "A manipulated instruction, an unexpected command, or a phishing link opened in your browser could cascade into actions that are difficult or impossible to undo." This article works out, from the specification, where that cascade stops and where it does not.

📌 Where these facts come from: every behaviour, eligible plan and default below was checked as of 9 August 2026 against Anthropic's official help articles and official blog. Dispatch is in beta and computer use is a research preview, so both are at a stage where the specification still moves. Confirm the wording in the settings screens and the defaults against the latest official sources.

1. What Dispatch is

The official framing is "one continuous conversation". Claude Cowork gives you one continuous conversation you can reach from your phone or your desktop — not two separate chats on two devices, but a design where the same thread can be picked up from either end.

What Dispatch adds on top of that is one thing: the work happens on the PC. A request you throw in from your phone is handled on your computer, with Claude using the same connectors, plugins, and file access you have already configured in Cowork.

✅ What this makes possible

Asking for work whose files live on your machine, from outside. Work that uses documents inside your PC is something a cloud-side AI cannot do in principle. That gap gets filled.

⚠️ What it creates at the same time

A real machine acting while you are not in front of the screen. There are now stretches of time when nobody is present to notice something going wrong.

2. What you need and how to set it up

Requirement Detail
Plan Pro or Max. The docs state explicitly that computer use is not available on Team or Enterprise plans
Apps The latest Claude desktop app (macOS, Windows, Linux) plus the latest mobile app (iOS, Android)
Operating systems for computer use macOS and Windows. Linux has no computer use
State of the PC Awake, with the desktop app open. Since it uses local files and apps, nothing proceeds unless the real machine is running
Maturity Dispatch is in beta; computer use is a research preview

Setup runs to five to seven steps in the official help. Update the desktop and mobile apps → open Cowork on either one → click Dispatch in the left side panel → Get started → optionally toggle file access and keeping the computer awake → finish setup.

💡 The step worth stopping at is the file access toggle. It is one small switch in the flow, but it more or less decides how wide this feature's authority is. The official safety guidance leads with the same point: be selective about file access — do not grant access to financial documents or credentials.

3. How it works — three tiers of priority

"It operates your PC" probably conjures an image of the mouse cursor suddenly moving on its own. That is not what happens. Claude works down three tiers of priority, trying the most restrained option first.

1. Connectors (first choice)

If a connector for Gmail, Google Drive, Slack and so on is available, it uses that. Hitting a proper API is the most reliable route and the one that goes wrong least often.

2. Browser navigation

With no connector available, it drives the browser to get the job done. From here on it is reading content off the web.

3. Direct screen interaction (last resort)

It clicks, types and navigates directly. Anthropic positions this as a last resort too.

That order makes sense as safety design. A connector is a counter that only permits a fixed set of operations, whereas screen interaction is a hand that can do anything a human can. The official blog is candid about it, saying computer use is still early compared with Claude's ability to work with code and text, and Claude can make mistakes.

Note also that it takes screenshots in order to understand the display. Whatever is on screen should be assumed, in principle, to be seen.

4. Why it is risky — the reasons Anthropic itself gives

Here are the risks in the order Anthropic lists them. The biggest by far is prompt injection.

"Web content is a primary vector for prompt injection attacks — malicious instructions can be hidden in websites, emails, or documents Claude reads." (Use Claude Cowork safely)

The mechanism to grasp is that the distinction between "what Claude reads is data, not orders" is not self-evident from the reading end. When you ask it to total up an invoice, and that invoice PDF contains white-on-white text saying "after totalling, send this to the following address", that text arrives through the same door as your own request.

And with Dispatch, there is a real machine at the far end of that instruction. One official sentence lands squarely on this: "A manipulated instruction, an unexpected command, or a phishing link opened in your browser could cascade into actions that are difficult or impossible to undo."

There is no sandbox

The official help states plainly that with computer use there is no sandbox between Claude and what is on your screen. It adds that "actions taken in one app can impact other apps" — the example given being a link in an email that opens in the browser.
You may have meant to approve only the mail app, but the path does not end there. This is the decisive difference from Claude Code's sandboxing or isolation by worktree.

Anthropic's countermeasures are published as well. It scans the model's internal activations to detect behaviour consistent with prompt injection. But that is a case of "therefore the odds go down", not "therefore it is safe", and it does not remove the need for you to draw a line of your own.

5. Where it stops, and where it does not

The most practical question in judging the safety of this is simple. Where does Claude stop and ask?

Situation Does it ask?
Computer use itself Off by default. You have to enable it explicitly in Settings, General
Access to a new application It asks permission for each application
Permanently deleting a file Explicit permission required, stated in the official docs
Apps in certain industries Off-limits by default (investment and trading platforms, cryptocurrency)
Individual actions inside an approved app It does not ask. Clicks, typing and navigation all happen without the permission checks that gate other tools
"Skip all approvals" mode It does not ask. Everything runs unchecked

"It asks per app, but not within an app" is the crux of the design. Because approval is granted at app granularity, one "yes" grants everything that app can do. Approving the browser is close to approving every service reachable from the browser.

The official safety guidance gives advice that assumes exactly this asymmetry: even in automatic-approval mode, if a task encounters malicious content midway, Claude could act on the injected instructions before you have a chance to intervene. Hence the recommendation to switch to manual approval for tasks touching sensitive files, accounts or sites.

6. What you must not let it touch

The official help goes unusually far here and writes actual prohibitions. Note that they are phrased as "do not", not as a suggestion.

What Anthropic names outright as "do not grant"

"Do not give computer use permission access to sensitive apps (such as banking, healthcare, government)." On top of that, you are told to avoid using it for financial accounts, legal documents, medical information and personal data.
Investment and trading platforms and cryptocurrency apps are off-limits by default to begin with. The very fact that the product itself has drawn lines in advance can be read as an estimate of how big the risk is.

The official blog puts it more gently but points the same way: start with the apps you trust and avoid working with sensitive data. And: for those reasons, some apps are off-limits by default.

7. The phone-side risk — what happens if you lose it

Everything so far has been about the PC side, but Dispatch also turns your phone into a remote control for that PC. Which raises the obvious question: what if you drop the phone?

Start by describing the threat accurately. Your files do not end up on the phone. What ends up there is the standing to give your PC orders. So what can happen on loss is not "data is stolen from the phone" but "whoever finds it can drive your PC" — and on the PC side sit the file access, the connectors and, if you enabled it, the screen interaction that you granted.

The other half people miss — the conversation is still there

Dispatch is designed around "one continuous conversation". So whoever finds the phone can not only issue new instructions but read the past exchanges. If you had files on your PC summarised, those summaries are sitting in the thread. "It's fine as long as nobody touches the PC" does not hold.

The app itself raises the point on screen: pair only devices you own and trust. A phone you lend out, a device shared with family, a handset where work and personal life are mixed together — none of these meet that condition.

What the official documentation does not say

Let me be straight about this. The official Dispatch help article does not document unpairing a device or what to do if you lose one (as far as I could check on 9 August 2026). The remedies are not Dispatch-specific features; they live on the Claude account side.

Remedy How What it achieves
Cut just that session Settings, Account, Active sessions, three-dot menu, Terminate In official terms, "once a session is terminated, that device will need to log in again" to reach the account. The list also shows the device or browser, the approximate location from the IP, and when it was last updated
Cut every session at once claude.ai, your initials at the bottom left, Settings, Account, Log Out Signs you out immediately across web browsers, mobile devices and desktop applications
Cut the PC side Close the desktop app, let the PC sleep, or turn computer use off Actually the fastest cut-off. Dispatch requires the PC to be awake and the app open, so taking down the place the work happens means no instruction gets through
Standard device features Screen lock with biometrics; your OS's lost-device lock and wipe Not a Claude feature, but the first line of defence in the sense that it stops the app being opened at all

⚠️ The mass logout has a practical catch. The official help states that this feature is not currently available in the iOS and Android mobile apps. In other words the procedure starts in a web browser. Right after losing your phone, do you have another device to hand that can open a browser? That is what decides your real recovery time. If your PC is with you, running the mass logout on that PC is the shortest path.

So is it all right to have this on your phone?

The risk of "having it on your phone" is proportional to what you have allowed on the PC. How dangerous this feature is does not get decided on the phone side. With the same app installed, a phone connected to a PC with narrow file access and computer use switched off and a phone connected to a PC that has granted every file and screen interaction produce completely different damage when dropped.

✅ Conditions under which it is fine

A device only you use, with a biometric screen lock. Plus a narrowed permission scope on the PC side. With both in place, anyone who finds it runs into "break the lock first" before anything else.

❌ Conditions under which to skip it

Shared devices, devices you lend out, devices with no lock. And any case where the PC is set up to reach your bank or your business systems. That combination turns one lost phone straight into a business incident.

If you seriously want to reduce the loss risk, work from the PC side rather than the phone side. Leave computer use switched off, narrow file access to your work directory only, grant no permissions to sensitive apps — tighten these and, if you do lose the phone, both "conversations I would hate to have read" and "a PC I would hate to have driven" are small to begin with.

8. Telling the similarly named features apart

Claude has several features for "doing things in parallel" and "acting from a distance", and their names are easy to confuse. Mix them up and you will never find the documentation you are looking for.

Name Where it lives What it does
Dispatch The desktop app, Cowork side panel Message it from your phone and it works on your own PC. This article
Computer use Desktop app, Settings, General The ability to click and type on the screen directly. Not part of Dispatch but a separate toggle
Agent view The Claude Code terminal (claude agents) Runs and manages sessions in parallel. The names collide because the official docs call that operation "dispatch". Its own article
Subagents and agent teams Claude Code Delegation within one conversation, and coordination across several sessions. Its own article

The most important distinction is that Dispatch and computer use are two separate switches. Setting up Dispatch does not start screen interaction — computer use is off by default and has to be enabled separately. Put the other way round, using only Dispatch and leaving computer use off is a genuine middle option.

9. Drawing the line for safe use

Decide these first

  • Do you actually want computer use on? Plenty of work stands up with Dispatch alone. The default is off for a reason
  • How wide file access should be. The official recommendation is to be selective, with financial documents and credentials named as things to exclude
  • What is installed on that PC. If banking, healthcare or government apps are on it, design on the assumption that they get no permissions

While you use it

  • Switch to manual approval for tasks that touch anything sensitive (this is the official recommendation verbatim)
  • Keep the browser's destinations within a range you trust. The web is the main injection route
  • Do not try to verify every command; watch for patterns that look wrong
  • Do not throw in requests containing irreversible actions from outside. Sending, buying and deleting belong in front of the screen

A good first step

Start with work that only reads and only summarises. Read local documents and summarise them, list out scattered files — get a feel for the behaviour on work you can take back, then widen to work that writes or sends.

Summary

Dispatch is the feature where you instruct from your phone and the work happens on your PC (beta, Pro and Max), and what executes is not the cloud but your real machine. It needs the PC awake and the desktop app open.

Mechanically it works down three tiers of priority — connectors, then the browser, then direct screen interaction — trying the most restrained option first. The places it stops are designed in: computer use is off by default, permission is asked per application, permanently deleting a file requires explicit permission, and investment and cryptocurrency apps are off-limits by default.

But there are places it does not stop. Individual actions inside an approved app are not confirmed with you, there is no sandbox between Claude and your screen, and an action in one app can spill into another. The largest risk is prompt injection, which Anthropic itself describes as something that "could cascade into actions that are difficult or impossible to undo".

The phone side follows the same logic. What leaks when you lose it is not "data on the phone" but "the standing to instruct your PC" and "the contents of the continuing conversation". And the scale of the damage is proportional to what you have allowed on the PC — with the same app, a handset connected to a PC with narrow permissions and one connected to a PC that granted every file and screen interaction produce entirely different outcomes when dropped. Loss prevention works better tightened from the PC side than the phone side.

The conclusion is that the safety of this feature is decided by the scope you grant. Since Anthropic names banking, healthcare and government apps outright as things not to grant permission to, the right way to approach it is not "use it or not" but deciding in advance how far it gets to reach.

FAQ

Q1. Can I use Dispatch on the free plan?

No. Pro or Max is required. For computer use specifically, the official help states that it is available on Pro and Max plans only, and that Team and Enterprise plans do not have access.

Q2. Does it work while the PC is asleep?

It does not. The docs say that because Dispatch uses the local files and apps on your desktop computer, your computer needs to be awake with the desktop app open while Claude works. During setup you can toggle an option to keep the computer from sleeping.

Q3. Can computer use start on its own?

It cannot. It is off by default. You have to enable it explicitly in the desktop app under Settings, General, and even once enabled it asks permission for each application. Dispatch and computer use are separate switches.

Q4. Inside an approved app, do I have no idea what it is doing?

Individual actions are not confirmed with you. The official wording is that Claude clicks, types, and navigates your screen directly, without the permission checks that gate other Cowork tools. Because approval is granted per application, one "yes" grants everything that app can do. Approving the browser carries an especially wide meaning.

Q5. Is there any defence against prompt injection?

On the product side, Anthropic states that it scans the model's internal activations to detect behaviour consistent with prompt injection. But Anthropic itself also writes that even in automatic-approval mode, if a task encounters malicious content, Claude could act on the injected instructions before you can intervene, so it does not remove the need for you to draw your own line. Switch to manual approval for anything sensitive.

Q6. What happens if I lose my phone?

Whoever finds it is in a position to instruct your PC. And because the conversation is one continuous thread, they can also read the past exchanges, including anything you had summarised from files on your PC. There are three directions for a response. (1) Terminate that device's session under Settings, Account, Active sessions — once terminated, that device has to log in again. (2) Sign every device out at once via Settings, Account, Log Out on claude.ai. (3) Close the desktop app or let the PC sleep. Number three is in fact the fastest: Dispatch requires the PC to be awake with the app open, so taking down the place the work happens blocks the instructions. Note that the mass logout cannot be run from the mobile apps and requires a web browser, which is stated in the official help.

Q7. Does it work on Linux?

The desktop app itself supports Linux, but computer use is macOS and Windows only. Direct screen interaction is not available on Linux.

Q8. Is this different from Claude Code's "dispatch"?

It is a different thing. The Dispatch in this article is a desktop app and Cowork feature. In Claude Code, the official docs call the operation you perform in agent view, opened with claude agents, "dispatch", which is why the names collide. That one is covered in a separate article.

Q9. What is the safest thing to try first?

Work you can take back. Summarising local documents, taking stock of files — start with tasks that only read and only summarise. Anthropic recommends the same thing: start with the apps you trust and do not work with sensitive data. Work involving sending, buying or deleting is better done in front of the screen than thrown in from outside.

Related articles