Anthropic Told You Not to Use Claude Dispatch for Regulated Workloads. Here's What That Means.

Anthropic’s own Help Center doesn’t tell you, in one sentence, to keep Claude Dispatch away from regulated data. But add up what it does say, spread across half a dozen support articles most users will never read, and the message is hard to miss. Cowork sessions aren’t eligible for Anthropic’s HIPAA Business Associate Agreement “in any configuration.” Local sessions, the kind Dispatch runs on your desktop, store conversation history in a way that “cannot be centrally managed or exported by admins.” And Anthropic is direct that its own monitoring option “doesn’t replace audit logging for compliance purposes.”

Read together, that’s about as close as a frontier AI vendor gets to publishing a “don’t use this for regulated workloads” sign on one of its own products (it’s just scattered across documentation instead of stated in one place, which is exactly why most teams miss it).

Dispatch is the feature that lets you send tasks from your phone to a Claude instance running on your desktop. It launched as a research preview in March 2026 and spread quickly to Pro, Max, Team, and Enterprise plans. The buzz has been about productivity. The documentation, if you read it, is mostly about risk.

This is a post about reading the documentation.

What is Claude Dispatch, once you strip away the launch hype?

Dispatch is straightforward in concept. You have the Claude Desktop app running on your Mac or Windows machine. You pair it with the Claude mobile app by scanning a QR code. From then on, you have one continuous conversation that follows you from device to device. You can text Claude from the grocery store and come home to finished work.

What makes Dispatch different from a normal Claude conversation is what the desktop Claude can do while you’re away. It can read and edit your local files. It can call your connectors. Through a feature called Computer Use, it can operate your actual desktop apps the way you would: clicking, typing, taking screenshots, running commands.

That’s the value proposition: your computer becomes an autonomous agent you can delegate to (and that’s also the threat surface).

Why does it matter that Dispatch’s Computer Use runs outside the sandbox?

Here’s the part that gets missed in most coverage. When Anthropic first released Computer Use in October 2024, its reference implementation ran inside a Docker container, explicitly for isolation. Anthropic’s own guidance for it calls for “a dedicated virtual machine or container with minimal privileges to prevent direct system attacks or accidents.” If Claude got tricked into downloading malware, the malware landed in a throwaway container. Cleanup meant deleting the container.

Cowork keeps that isolation for the parts of the job that need it: shell commands and any code Claude writes still “execute inside a dedicated Linux VM, isolated from the host operating system,” per Anthropic’s own architecture documentation. But Dispatch’s Computer Use, the part that clicks, types, and navigates your screen, doesn’t get that boundary. Anthropic says so directly: “Computer use has no sandbox between Claude and your applications. Claude interacts directly with your desktop, apps, and browser.”

That’s a change to the threat model itself.

The same prompt injection attacks security researchers demonstrated against the 2024 version now land in a very different place. When Johann Rehberger showed in October 2024 that a poisoned webpage could convince Claude to download and execute malware, the attack ran against a Computer Use instance built around that same Docker-container guidance. HiddenLayer’s later research demonstrated indirect prompt injection against Claude’s Computer Use through content the model was asked to read, not content the user typed. PromptArmor went further in January 2026, just two days after Cowork’s public launch: a hidden instruction directed Claude to upload local files to an attacker’s account using curl, and it worked specifically because Anthropic’s own file-upload API was allow-listed on network egress that otherwise blocked most destinations.

Your Dispatch session has access to your Keychain, your SSH keys, your browser cookies, your signed-in production consoles, your Slack workspace, and whatever else you’ve granted it. A successful prompt injection against a sandboxed Computer Use instance is contained by the sandbox. A successful prompt injection against Dispatch runs on the machine itself, which is the same class of gap that let another agentic Claude deployment wipe a production database in nine seconds: the model behaved as designed, and the failure was in what it was allowed to touch unsupervised.

What compliance carve-outs does Anthropic’s own documentation admit to?

Anthropic’s Help Center article on Team and Enterprise Cowork is unusually direct. It tells you, in plain language, what Dispatch isn’t covered by. Here’s what that list actually looks like when you’re the person responsible for compliance at a small or mid-size firm in a regulated industry.

• No admin-managed audit trail for the sessions Dispatch actually runs. Cowork via mobile and web is captured in Anthropic’s Compliance API, but Dispatch runs local sessions on your desktop, and those are explicitly excluded: local conversation history “is not subject to Anthropic’s standard data retention policies and cannot be centrally managed or exported by admins.” That’s precisely the artifact your SOC 2 auditor samples, and what your insurer asks for when something goes wrong.
• No HIPAA Business Associate Agreement coverage, on any plan. Anthropic’s own documentation states that Cowork “is not an Eligible Service under the BAA in any configuration” and “shouldn’t be used with PHI.” If you’re a covered entity processing PHI, Dispatch is off the table full stop, not just on lower-tier plans.
• No Zero Data Retention eligibility. Anthropic’s ZDR agreements cover eligible APIs, products using a commercial API key, and Claude Code for Enterprise. Cowork isn’t on that list, even on Enterprise plans that have ZDR enabled for other capabilities.
• Access control that’s all-or-nothing on Team plans. On Team plans, the Cowork toggle is organization-wide: everyone has access or no one does, with no way to scope a pilot group. Enterprise plans can use groups and custom roles for more granular control, but the default posture most SMBs hit first is all-or-nothing.
• Local-only conversation history. The record of what Claude did, said, and saw lives on the user’s machine, not centrally exportable and not visible to admins. That makes it hard to respond to a GDPR access or deletion request, or to place a clean litigation hold, without involving the user’s device directly.
• Screenshots retained on Anthropic’s backend for up to 30 days. Computer Use works by sending images of your screen to Anthropic’s inference endpoint. By default, Anthropic “will automatically delete all screenshots from our backend within 30 days, unless the customer and Anthropic have agreed to different terms,” and its own documentation acknowledges those screenshots can include “personal data, sensitive documents, or private information” visible on screen at the time.

Each of these maps cleanly to a control your auditor cares about, and Anthropic isn’t hiding any of it. The real question is whether your organization has the governance literacy to read the documentation and respond.

What reliability problem do most governance frameworks not have a clause for?

MacStories ran Dispatch through 13 hands-on tasks in its first weeks: 5 succeeded, 3 landed as partial successes, and 5 failed outright, leading the reviewer to call it “about a 50/50 shot whether what you try will work.” FindSkill’s multi-week testing reported similar inconsistency. That’s a research-preview problem, and Anthropic has been upfront about the label.

The real governance issue is the silent failures: tasks that show “seen” and never resolve, runs that drop the thread partway through without delivering output, scheduled tasks that stop following their original instructions after a few runs, multi-device setups where Computer Use acts on the wrong machine. Usage keeps metering against your quota the whole time, and Anthropic hasn’t published an SLA or a credit policy for sessions that burn tokens and produce nothing.

Most AI management frameworks ask about reliability in terms of accuracy and drift. They rarely ask what happens when a system fails silently while continuing to charge for the attempt. That question belongs in your Measure function under NIST AI RMF, and in your Impact Assessment under ISO 42001 A.6.2. Right now, for most organizations, it’s missing entirely, in part because most teams don’t yet have a way to size how much a given AI failure actually matters once it happens.

How does Claude Dispatch map to ISO 42001 and NIST AI RMF?

Here’s the practical mapping, kept tight.

• Govern (NIST) and A.2.2 / 8.4 (ISO 42001): Your AI Use Policy probably doesn’t name agentic remote-control tools as a separate capability class. It should. Dispatch is structurally different from a chat interface or a scheduled batch job, and the policy needs to say so.
• Map (NIST) and A.6.2 (ISO 42001): Your Impact Assessment for Dispatch needs to cover primary-machine execution and the prompt injection blast radius specific to your data.
• Measure (NIST) and 9.1 (ISO 42001): OpenTelemetry export exists for Enterprise, and Anthropic is direct that it “doesn’t replace audit logging for compliance purposes.” You’ll need compensating controls: a pipeline to your SIEM, a defined session-review cadence, and reliability metrics that include silent-failure rate and quota burn.
• Manage (NIST) and A.9 (ISO 42001): Anthropic’s own accumulated carve-outs, no BAA coverage, no centrally-managed audit trail for local sessions, no ZDR eligibility, become your written restriction, signed by legal and security, documented in your management review.

The pattern to notice: Anthropic has already done much of the input work for governance. They’ve published the warnings, itemized the carve-outs, and kept the research-preview label in place even on paid Team plans. Your job is to operationalize what’s already in plain sight.

What should SMBs in regulated industries actually do about Dispatch?

Here’s a three-tier framework that maps to how most small and mid-size firms actually make these decisions.

What’s the real pattern underneath Anthropic’s warnings?

What makes Dispatch’s documentation interesting is that Anthropic published these warnings at all. The compliance carve-outs, the research-preview label on paid plans, the accumulating signal that this isn’t ready for regulated use: these add up to an unusually direct disclosure from a frontier AI vendor, even without a single quotable sentence saying so.

The real question is whether your organization is set up to read them and respond.

This is the quieter discipline of reading the documentation a vendor already published and translating it into policy your team will actually follow, and that’s what responsible AI implementation looks like at an SMB or mid-market firm.

That’s the work we do at Violet Beacon. If you’d like help building an AI Use Policy that accounts for agentic tools like Dispatch, or you want a second pair of eyes on whether your organization should enable a capability like this for any category of work, explore our services or read our Responsible AI Guidelines.

Key References

• Anthropic, Put Claude to work on your computer (blog, March 23, 2026)
• Anthropic, Cowork on Team and Enterprise plans
• Anthropic, Let Claude use your computer in Cowork
• Anthropic, Claude Cowork architecture overview
• Anthropic, Covered Models under a Business Associate Agreement (BAA)
• Anthropic Privacy Center, What personal data will be processed by Computer use?
• Anthropic Privacy Center, Zero Data Retention: what products does it apply to?
• Anthropic, reference Computer Use implementation (GitHub)
• MacStories, hands-on with Claude Dispatch
• FindSkill, Claude Dispatch guide
• Johann Rehberger, ZombAIs: Claude Computer Use C2
• HiddenLayer, indirect prompt injection of Claude Computer Use
• PromptArmor, implement Claude Cowork securely
• Harmonic Security, securing Claude Cowork
• MintMCP, the Claude Cowork audit logging gap
• ISO/IEC 42001:2023, Artificial intelligence management system
• NIST AI Risk Management Framework