Two months ago, nobody was talking about remote AI desktop agents.

Then Peter Steinberger dropped OpenClaw on GitHub. Free. Works with any LLM. Connects over Telegram, WhatsApp, or Discord. Over 320,000 stars in two months — one of the fastest-growing open-source projects in AI history.

The premise was simple: your AI should be reachable from your phone. It should run tasks on your computer while you're away. It should feel less like a tab you open and more like something that works when you're not watching.

The community went wild. Developers forked it, extended it, built skills on top of it. Jensen Huang said every company needs an OpenClaw strategy.

Then the vulnerabilities surfaced.

The Wild West Phase

It didn't take long.

CNCERT — China's national cybersecurity agency — issued warnings about OpenClaw. Security researchers flagged prompt injection risks: malicious instructions embedded in web pages or documents that hijack what your agent does. Infostealers started targeting config files where API keys and credentials live. One compromised config, and your AI agent becomes someone else's automation tool.

None of this is surprising. This is how open-source adoption curves work. A tool gets popular fast. Security catches up slow. Enterprises watch from the sidelines.

But something else was happening at the same time. The open-source community was proving demand. Hundreds of thousands of people wanted exactly this: an AI that does work on their machine, reachable from anywhere, running while they sleep.

Anthropic was watching.

What Dispatch Actually Is

On March 17, 2026, Anthropic shipped Dispatch as a research preview inside Claude Cowork.

The pitch: one persistent conversation between your phone and your desktop. You send a task from the Claude mobile app. Claude runs it locally on your Mac or Windows machine — reading your files, using your configured connectors, building reports, drafting documents. You come back to finished work.

If you're comparing specs, Dispatch loses. OpenClaw has 100+ built-in skills. It works with any model. It connects over the messaging apps you already use. Dispatch gives you one thread, requires the machine to stay awake, and only works with Claude.

But here's what Anthropic actually shipped underneath the feature:

End-to-end encrypted connection between your phone and desktop. Sandboxed execution — Claude can only touch the folders and apps you've explicitly shared. Before any destructive action, it stops and asks. A push notification to your phone before anything gets deleted, moved, or sent.

That's not a feature list. That's an architecture decision. A philosophical one.

The Pattern Nobody's Naming

This isn't the first time we've seen this play.

Cloud vs. open source. iOS vs. Android. Zoom vs. every SIP client that came before it. The open ecosystem wins the early adopters. The controlled platform wins the enterprise. Every time.

The "safe" option always looks worse on the spec sheet. Fewer features. More restrictions. Higher price. And then, somewhere around year three, a CISO sends a memo. Or a compliance audit happens. Or a vendor gets breached. And suddenly the boring, locked-down, expensive option is the only one on the approved list.

Dispatch is Anthropic making a specific bet: that agentic AI is about to cross from productivity territory into compliance territory. And they want to own the infrastructure when it does.

Think about what an AI desktop agent actually does. It reads your files. It accesses your email and Slack. It can move things, delete things, send things on your behalf. For an individual user, that's powerful. For a company with 500 employees running autonomous agents on their machines — that's a legal surface area that keeps your general counsel up at night.

OpenClaw doesn't have a story for that. It's not built to have one. That's not a criticism — it's a design choice. Open-source tools optimize for capability. Anthropic is optimizing for something different.

The Two Races

There are actually two races happening right now, and most coverage is only watching one of them.

Race 1: Features. Who has the most skills, the best integrations, the most powerful underlying model. OpenClaw is winning this race. So are a dozen other open-source projects. The gap closes every month.

Race 2: Trust infrastructure. Who gets added to the enterprise approved vendor list. Who passes the SOC 2 audit. Who has the indemnification clause that legal will accept. Who can promise your CFO that the AI agent touching payroll data has a human checkpoint before it does anything irreversible.

Anthropic is not trying to win Race 1. They've built Claude Code for developers who want raw capability. They have the API for builders who want control. Dispatch is built specifically for Race 2.

The sandboxing, the encryption, the human-in-the-loop pauses — none of that makes the product more capable. All of it makes the product more deployable. There's a difference.

Why This Moment Matters

The interface layer is being claimed right now.

Not the model layer — that's commoditizing fast. Not the application layer — there are thousands of apps. The interface layer: the persistent, trusted connection between a human and an AI agent that does real work on real systems.

Whoever owns that layer in enterprise settings — whoever becomes the default approved desktop AI — will be extraordinarily hard to displace. Not because they'll have the best features. Because they'll be embedded in procurement, compliance, and IT policy. Because switching costs in enterprise AI aren't about capability. They're about recertification.

Dispatch is rough today. One thread. No background execution. The machine has to stay on. But research previews have a way of becoming the default.

OpenClaw showed everyone what's possible. Anthropic is building what's permissible. In enterprise software, permissible beats possible. Almost every time.

The question worth sitting with isn't "Is Dispatch better than OpenClaw?"

It's: who decides what AI agents are allowed to do on corporate machines — and when does that decision get made?

Anthropic shipped Dispatch the week that question started getting asked.

That's not a coincidence.

Related reading

• Stop Dumping Tools Into Context. It Doesn't Scale — The same infrastructure-first argument, one layer up the stack.

• The Prompt Is Dead. Here's What Replaced It — How Anthropic's platform bets compound over time.