Claude Dispatch Security and Privacy: What the Official Docs Say

Claude Dispatch lets you send a task from the Claude mobile app and have Claude work with the files, connectors, plugins, and applications available through Claude Desktop. That convenience creates a remote path into a powerful local agent, so its security cannot be reduced to “the traffic is encrypted.” The important questions are what data crosses the service, where work executes, which resources Claude can reach, how approvals behave, and what happens if an account, device, plugin, or source document is compromised.

Anthropic's current documentation does not support the common claims that Dispatch is end-to-end encrypted from phone to computer, that Anthropic can never read task content, or that no task data is stored on its servers. The official Dispatch guide instead describes a persistent conversation that syncs across devices.

What Claude Dispatch is

Anthropic describes Dispatch in Claude Cowork as a continuous conversation available from mobile and desktop. A task sent from the phone can use the local files, connectors, plugins, browser, and computer-use capabilities already configured in Cowork. Dispatch tasks run through the desktop computer, so the computer must be awake and Claude Desktop must be open for local work.

This is different from a general Cowork cloud session. Anthropic's current Cowork surface guide says cloud sessions execute on Anthropic infrastructure and save sessions and files to the Claude account. Those sessions can reach connected local folders or desktop capabilities only while the desktop app is open.

Because the product is evolving, verify which session type you are starting and read the current documentation for your plan before approving sensitive use.

Correcting the main security claims

Claim	What the official documentation supports	Practical conclusion
“Dispatch is protected by TLS 1.3 plus end-to-end application encryption.”	Anthropic documents secure remote access and TLS for Claude Code Remote Control, but the Dispatch help page does not establish user-device-only end-to-end encryption or a second cryptographic layer.	Rely on published product and contract terms; do not assume the service is unable to access content.
“Relay servers cannot read task contents.”	Dispatch uses a persistent thread that syncs across mobile and desktop. Anthropic does not describe that thread as an opaque payload readable only by the two devices.	Treat prompts, responses, and supplied context as data processed by the Claude service.
“Nothing is stored after the session.”	The Dispatch thread persists and carries context across tasks. Cowork tasks can be deleted; Anthropic says deletion removes a task from history immediately and schedules backend deletion within its documented retention period.	Configure and verify retention rather than assuming ephemerality.
“Files never leave the computer.”	Local work and filesystem access may occur through Claude Desktop, but prompts, selected file content, screenshots, tool results, summaries, and generated outputs may become part of the session or be sent to connected services.	“Local execution” does not mean “no data leaves the device.” Trace each data flow.
“Approvals prevent harmful actions even if a session is compromised.”	Claude has permissions and approval mechanisms, but their behavior depends on feature, mode, tool, and configuration. Anthropic warns that mistakes or malicious content can trigger real actions.	Approvals help; least privilege, isolation, and recovery controls remain necessary.
“Public Wi-Fi is safe because traffic is encrypted.”	Encrypted transport reduces passive interception, but it does not protect against a stolen authenticated phone, phishing, malicious browser content, overbroad connectors, or a compromised endpoint.	Use normal untrusted-network controls and follow organizational policy.

Map the real data flow

A Dispatch task can involve several distinct paths:

1. Mobile to Claude account: the instruction becomes part of a synced Dispatch conversation.
2. Claude service to desktop: the task reaches Claude Desktop and may start Cowork or Claude Code work.
3. Desktop resources: Claude may read a connected folder, use a local plugin, control a browser, or interact with an application.
4. Model and tool context: relevant file passages, screenshots, connector results, or command output may be provided to the model.
5. Connected services: remote connectors can retrieve or write data under the user's permissions; browser automation can act within signed-in sites.
6. Result back to the thread: a summary, artifact, link, or file becomes available to the phone and other account surfaces.

The statement “the spreadsheet stays on the Mac” can be literally true while its contents or a derived summary still travel through the model session. Classify the information, not only the file location.

Local, cloud, and remote-control models are not interchangeable

Mode	Where execution occurs	What still leaves the device	Main review question
Dispatch with desktop resources	Desktop-backed work uses Claude Desktop and local capabilities	Synced conversation and any context/results used by Claude or connected services	Which folders, apps, browser sessions, connectors, and plugins can the task reach?
Cowork cloud session	Anthropic-managed cloud environment	Session files, prompts, outputs, connector data, and other task context	Are cloud sessions allowed for this data class and plan?
Claude Code Remote Control	Local Claude Code process	Anthropic documents TLS traffic and a server-stored transcript while connected for cross-device sync	Are remote control, trusted devices, and repository permissions configured?
Fully local, offline software	Local device	Nothing by design unless the software calls an external service	Are models, telemetry, updates, plugins, and network access truly local?

Do not apply Claude Code Remote Control documentation automatically to Cowork Dispatch. They are related remote workflows with different feature surfaces and documentation.

Permissions are the most important control

Dispatch can use “everything on your desktop” only to the extent that Claude Desktop, the logged-in operating-system user, connected browser profile, connectors, and plugins permit. Reduce that authority before focusing on network encryption:

• connect only the folders needed for the task;
• use a non-administrator operating-system account;
• separate sensitive browser sessions from the profile Claude can access;
• authorize connectors with the narrowest available scope;
• disable write tools when read-only access is sufficient;
• remove unused plugins and inspect their publisher, code, permissions, and update source;
• keep irreversible or externally visible actions behind explicit confirmation;
• use a disposable workspace, branch, or backup for file-changing tasks.

A connector inherits the user's source-system access. If a user can read an entire shared drive, adding that connector may make the same material reachable through Claude. Overbroad human permissions become overbroad agent permissions.

Understand approval modes and their limits

Approval behavior is not one universal “gateway.” Claude in Chrome, Claude Code, Cowork computer use, connectors, and plugins have their own permission controls. For example, Anthropic's Chrome permission guide distinguishes manual approval, automatic approval, and a mode that skips approvals.

For sensitive work:

• use the most restrictive mode that still permits the task;
• read the exact target, data, and effect—not only the button label;
• reject bundled approvals that authorize more than the next necessary step;
• do not approve a surprising action to “help the task continue”;
• verify the result in the authoritative application;
• maintain backups and service-side version history.

Approval prompts cannot reliably protect a user who approves without understanding the action, and they do not replace a control that makes the action impossible.

Prompt injection remains a core risk

A file, webpage, email, Slack message, or tool result can contain instructions intended to redirect the agent. Anthropic explicitly warns that malicious content encountered by a desktop agent can cause mistakes or real consequences. Its browser safety guidance notes that visible page content can enter screenshots and become conversation context.

Reduce exposure by using allowlisted sites, separate browser profiles, read-only sources, minimal context, and human confirmation before meaningful external actions. TipsMake's guide to prompt injection and indirect attacks explains why filtering alone is insufficient.

Secure both endpoint devices

Desktop

• Enable FileVault on macOS or BitLocker/device encryption on Windows where supported and required.
• Use a strong account password, automatic screen lock, and platform updates.
• Run Claude under a standard user, not an administrator, when practical.
• Keep confidential files outside connected folders unless required for an approved task.
• Back up important data and test restoration before allowing bulk edits.
• Use endpoint detection, firewall, MDM, and logging controls required by the organization.
• Close Claude Desktop or disable Dispatch when remote access is not needed.

Phone

• Use a strong device passcode and biometric lock.
• Keep the OS and Claude app updated.
• Hide sensitive notification previews on the lock screen.
• Do not share the Claude account or leave an authenticated device unlocked.
• Use device-finding and remote-lock capabilities.
• Review and revoke account sessions or trusted devices after loss, theft, or role change.

On supported Team or Enterprise Claude Code Remote Control deployments, Anthropic documents an optional Trusted Devices control that ties access to an enrolled device and recent authentication. Confirm whether the control applies to the actual Dispatch/Cowork workflow before relying on it.

Public Wi-Fi: use a risk-based checklist

TLS protects data in transit from ordinary passive observation, but “encrypted” is not equivalent to “safe in every café or airport.”

• Prefer a trusted cellular connection or approved hotspot for sensitive work.
• Use the organization's VPN if policy requires it; a VPN does not make a compromised endpoint safe.
• Disable unnecessary local sharing and ignore captive-portal certificate warnings.
• Verify the network name and do not install profiles or certificates offered by the venue.
• Avoid viewing confidential output where it can be shoulder-surfed or captured in notifications.
• Stop if the browser, app, or login flow behaves unexpectedly.

Retention, memory, and deletion

The Dispatch conversation is designed to retain context across tasks. Anthropic also says users can view, edit, and delete memory. Cowork task deletion removes the task from visible history and schedules deletion from backend storage according to the documented retention period; organization-level policies may differ.

Before deployment, record:

• whether memory is enabled and who can change it;
• the retention period for conversations, task files, recordings, logs, and connector data;
• whether administrators can export or monitor the content;
• how deletion propagates to backups and connected services;
• whether consumer data-improvement settings or business terms apply;
• which outputs are copied into local files, email, Slack, or other systems.

“Delete the chat” may not delete a document that Claude already wrote to a connected service.

Regulated and confidential data

Do not infer compliance from encryption, local execution, or a general security certification. Healthcare, payment-card, financial, export-controlled, legal, employment, and personal data may require a specific plan, contract, configuration, region, audit record, and approved subprocessors.

An organization's security and legal teams should review the actual architecture, product terms, Data Processing Addendum, retention settings, connector permissions, incident process, and any required BAA or sector agreement before use. TipsMake's guide to Claude Code in VS Code gives a narrower development workflow where repository permissions and diff review can be controlled.

Lost-device response

1. Use the platform's device-finding service to lock the phone or computer.
2. From a trusted device, change or secure the identity-provider and Claude credentials as required.
3. Review active sessions and revoke the lost device or trusted-device credential where available.
4. Disable Dispatch or Remote Control at the organization level if the exposure is uncertain.
5. Revoke sensitive connectors, plugins, and downstream tokens that the session could access.
6. Notify the organization's security team and preserve relevant logs.
7. Assess which conversations, folders, applications, and notifications were reachable.
8. Follow the incident plan for any regulated or customer data involved.

A defensible deployment checklist

• Confirm the current Dispatch, Cowork, or Remote Control mode and where it executes.
• Classify the data and obtain organizational approval.
• Document synced conversation content and retention.
• Restrict folders, connectors, browser profiles, plugins, and write tools.
• Use manual approval and tested backups for destructive actions.
• Secure both devices and the Claude account.
• Test prompt injection, mistaken actions, and recovery.
• Monitor product release notes because the beta architecture and controls can change.
• Re-review after enabling cloud sessions, computer use, a new plugin, or a broader connector.

Claude Dispatch can be used responsibly, but the defensible case is not “Anthropic cannot see anything.” It is that the organization understands the actual data flow, has approved the service terms, limits what the agent can reach, and can detect and recover from mistakes.