Claude AI Can Now Control Your PC, Prompting Concern From Security Experts

PCMag editors select and review products independently. If you buy through affiliate links, we may earn commissions, which help support our testing.

With its latest update, the Claude AI tool from Amazon-backed Anthropic can control your computer. The idea is to have Claude "use computers the way people do," but some AI and security experts warn it could facilitate cybercrime or impact user privacy.

The feature, dubbed "computer use," means Claude can autonomously complete tasks on your computer by moving the cursor, opening web pages, typing text, downloading files, and completing other activities. It launched first for developers via the Claude API and is included in the Claude 3.5 Sonnet beta, but could be added to more models in the future. Anthropic warns that this new feature could be faulty or make mistakes, however, as it's still in its early stages.

Anthropic says companies like Asana, Canva, and DoorDash are already testing this new feature, asking Claude to complete jobs that normally require "dozens, and sometimes even hundreds, of steps to complete." This could mean a more automated US economy as employees automate tasks at work, helping them meet deadlines or get more things done. But it could also lead to fewer jobs if more projects ship faster.

Claude may refuse to do certain tasks that could fully automate your social media and email accounts. One coder, however, claims he's been able to create a "wrapper" that circumvents those restrictions.

'I'm breaking out into a sweat thinking about how cybercriminals could use this tool.'

From a security standpoint, Jonas Kgomo, founder of the AI safety group Equianas Institute, called Claude's computer use "untested AI safety territory" and emphasized that cyberattacks are entirely possible with the new tool.

Parrot AI founder Paul Morville tells PCMag in a message that while Anthropic's advice to only use the new feature when you can supervise it is wise, "there is enormous potential for both intentional and unintentional security problems" and could one day be used to help hackers deploy autonomous remote access trojans (AI RATs).

Rachel Tobac, self-described hacker and CEO of cybersecurity firm SocialProof Security, said she's "breaking out into a sweat thinking about how cybercriminals could use this tool."

"This easily automates the task of getting a machine to go to a website and download malware or provide secrets, which could scale attacks (more machines hacked in a shorter period of time)," Tobac wrote on Tuesday. "I’m also imagining that websites could have malicious prompts visible to the AI tool that hijack the requested AI task!"

Tobac listed a number of possible scenarios where Claude's computer use could go wrong. It could result in less human responsibility and oversight, meaning people may be able to claim that they aren't responsible for the AI's actions if it leads to a cyberattack or causes a data breach, for example. Attackers could also design websites knowing the tool exists, and inject malicious code or prompts that could override the AI and get it to download malicious files or execute an attack.

"I’m majorly crossing my fingers that Anthropic has massive guardrails," Tobac adds. "This is some serious stuff."

But as Datasette creator Simon Willison points out, Anthropic is warning users that it doesn't have such guardrails because it can't stop the AI from being hijacked in certain situations.

"Our Trust & Safety teams have conducted extensive analysis of our new computer-use models to identify potential vulnerabilities," Anthropic writes in a post. "One concern they've identified is 'prompt injection'—a type of cyberattack where malicious instructions are fed to an AI model, causing it to either override its prior directions or perform unintended actions that deviate from the user's original intent. Since Claude can interpret screenshots from computers connected to the internet, it’s possible that it may be exposed to content that includes prompt injection attacks."

Anthropic justifies the release of the feature, however, by taking the stance that such a tool is inevitable. It argues that it's better to release it now while AI models aren't as powerful as they ultimately could be than later, in a hypothetical future.

"When future models require AI Safety Level 3 or 4 safeguards because they present catastrophic risks, computer use might exacerbate those risks," it said. "We judge that it’s likely better to introduce computer use now, while models still only need AI Safety Level 2 safeguards. This means we can begin grappling with any safety issues before the stakes are too high, rather than adding computer use capabilities for the first time into a model with much more serious risks."

Will Ledesma, a senior director at cybersecurity firm Adlumin, tells PCMag in a message that Claude's computer use is cause for concern considering Anthropic's use guidelines and how Claude might be storing or sharing sensitive data. "Recommending a virtual machine means they're already worried about what it might do. [But] breaking out of VMs or even containers to access root systems has not been impossible," Ledesma said.

"Also, there is a concern around where they are storing this sensitive data, such as the screenshots [as] they stated they would hand over screenshots if requested by law. This could be weaponized," Ledesma continued. "For example, if a bad guy gains access to this software, they can use it to monitor individuals. The trade-off here is ease of use against privacy. Many are willing to give up their privacy in order to make something 'easier', but that is the risk. Law enforcement could also abuse this if they used it against an endpoint that they have legal rights to monitor."