Anthropic's Claude AI Gains Background Control Over macOS and Windows
Anthropic's Claude AI can now execute tasks in the background on macOS and Windows, raising new security considerations for enterprises.
Anthropic has introduced a significant update to its Claude AI, enabling it to control macOS and Windows computers in the background. This new capability, available within Claude Cowork and Claude Code, allows the AI to perform tasks by simulating user actions like clicking and typing, without directly commandeering the user's active screen. The update is integrated into the Claude Desktop application for both operating systems, though the background execution mode is currently exclusive to macOS 15 and later.
On compatible macOS systems, Claude operates applications in separate background windows, permitting users to continue their foreground work uninterrupted while the AI handles other processes. Anthropic emphasizes that Claude does not seize the mouse or keyboard and is designed to pause if a user is actively typing, only requesting full-screen access when absolutely necessary for a task. This feature builds upon earlier iterations where computer control was available to developers via API and to Pro/Max subscribers for specific tasks.
The primary enhancement is the improved workflow and the ability for users to multitask alongside the AI. In Claude Cowork, the AI prioritizes native connectors for services like Gmail, Google Drive, Microsoft 365, and Slack. If these are unavailable, it will utilize the browser, and only as a last resort will it resort to direct screen interaction. This fallback mechanism is where security concerns arise.
Direct screen-level interaction bypasses the sandboxing typically present in code execution or file access, presenting a higher exposure risk according to Anthropic's own safety documentation. Potential use cases include compiling research from local files, testing mobile applications within simulators, and navigating internal enterprise tools that lack API integrations. The ability for Claude to directly interact with the desktop environment opens new avenues for exploitation.
Security teams are urged to scrutinize this agentic AI control closely. An AI agent with standing permissions to navigate email clients, internal portals, and development tools introduces novel prompt-injection and social-engineering attack surfaces. Malicious content on a webpage or within a file could potentially hijack the AI's next action, leading to unintended consequences.
Anthropic has stated that the background computer use toggle is manual and remains off by default for users who have not previously enabled it. Enterprises considering Claude Cowork are advised to treat this feature with the same caution as a new privileged automation account, requiring thorough review, monitoring, and defined scope before deployment.
This development underscores the growing sophistication of AI agents and the evolving threat landscape. As AI models become more integrated into daily workflows and gain deeper access to system resources, the potential for both productivity gains and security risks escalates. Organizations must proactively assess and mitigate these new vulnerabilities.