Claude Dispatch
Anthropic's Answer to OpenClaw — A Factual Assessment

To understand why Dispatch matters, you need the backstory. OpenClaw did not exist six months ago. Its creator, Peter Steinberger, released a project called Clawdbot in late January 2026 — a thin wrapper that let anyone run Claude as an always-on desktop agent. The project went viral instantly. By March 2, the repo had 247,000 GitHub stars.

Anthropic responded on January 27 with a cease-and-desist over trademark infringement on the "Claude" name. The project was renamed — first to Moltbot, then to OpenClaw. Then on February 14, OpenAI hired Steinberger and OpenClaw moved to an independent foundation with OpenAI as primary sponsor. Anthropic had pushed away the builder, and OpenAI welcomed him in.

What observers largely missed in the cease-and-desist story was what Anthropic was building in parallel. Cowork had been in research preview since January 2026 — a sandboxed desktop agent product with a fundamentally different security posture than OpenClaw. Dispatch, the mobile-remote-control layer on top of it, shipped on March 17.

Claude Cowork is Anthropic's desktop agent product for non-developers. It lives as a new tab in the Claude Mac app alongside Chat and Code, and Simon Willison described it as "Claude Code for the rest of your work" — the same underlying agent architecture repackaged without the terminal. Cowork uses Apple's Virtualization Framework to boot a sandboxed Linux environment on your machine; files are mounted at /sessions/[name]/mnt/[folder] and the agent operates within that container.

Cowork supports folder-scoped file access (you choose what it can see), web navigation, form interaction, and artifact generation. As of January 30, Cowork also supports Agent Skills — a plugin system Anthropic has proposed as an open standard. Dispatch is the third pillar: the ability to initiate and monitor Cowork tasks from a phone.

Setup is designed to be quick. After updating the Claude Mac app, a Dispatch option appears in the Cowork section, prompting you to scan a QR code with your iPhone. Once paired, your phone's Claude app gains a Dispatch entry in its sidebar — a live link into the Cowork session running on your Mac. The Mac must be awake with the Claude app open; there is no server-side session persistence.

What worked in MacStories' hands-on testing: locating screenshots, summarizing Notion notes, accessing files already open in Cowork. What failed: opening new applications, accessing Terminal sessions, reading Safari tabs, sending via iMessage. MacStories characterized the overall experience as "rough around the edges" and "currently slow," with approximately a 50% success rate across attempted tasks.

The table below draws exclusively on publicly documented facts. "Success rate" reflects MacStories' independent Dispatch test; OpenClaw performance varies significantly by configuration and skill set.

Security is the single strongest argument for Dispatch. The fundamental difference between Dispatch and OpenClaw lies in isolation: OpenClaw runs with full user-space permissions and no mandatory sandboxing; Dispatch runs inside a virtual machine with default-deny networking and no direct filesystem access.

Industry assessments of OpenClaw's security posture have been consistently negative. The gap is not subtle — it is architectural.

The tradeoff is real, however. Simon Willison noted that prompt injection remains an active threat even within Cowork's sandbox — Anthropic acknowledges its defenses "aren't guaranteed" — and questioned whether typical users can realistically monitor for suspicious agent behavior. Dispatch's VM isolation reduces the blast radius of a successful attack, but does not eliminate the attack surface.

Dispatch's security advantages come with significant practical constraints. Four stand out as current blockers for serious adoption.

Claude Dispatch is a credible first step, not a complete alternative. As of March 18, 2026 — one day after launch — it is a research preview with a 50% task success rate, a macOS requirement, a $100/month price floor, and no developer API. On those terms, OpenClaw remains the more capable and accessible tool for anyone comfortable with the security tradeoffs.

What Dispatch does solve — and solve meaningfully — is the security objection that has kept OpenClaw out of professional and enterprise environments. The sandboxed VM, the default-deny networking, and the absence of raw filesystem access represent a genuinely different architecture. Mollick's framing holds: Dispatch covers a large share of the use cases with a substantially smaller attack surface. Whether that is enough depends entirely on what you are trying to do.