How to pick a desktop AI agent

Installing one is the easy part. You download the desktop app, sign in with the subscription you already pay for, open the extensions directory and switch on filesystem access, and a program on your laptop can now read your documents, your calendar and your messages [2]. Nothing in that sequence asks the question that decides whether this was a good idea. Which folders. Under what permission. And what happens the first time one of those documents contains instructions written by someone who is not you.

The comparison most people reach for is which model is smartest, and it is the least useful one on the table. Claude, ChatGPT, Visual Studio Code and Cursor all speak the same connector protocol, so the integration work you do is not tied to any one of them [7]. What separates them is the permission model, the plan you would have to be on, and how much of your machine each one assumes it may use. This guide is a procedure for choosing on those grounds instead. It is written for a solo operator or a team under about 20 people, working on laptops they own and pay for. If you have a managed fleet and someone whose job title contains the word security, they have opinions that outrank this page, and they should.

Four different products are sold as desktop agents

Work out which of four things you are looking at before you compare anything, because they differ by an order of magnitude in what they can reach.

The first is a chat assistant with local extensions. The Claude desktop app runs on macOS 11 or higher and Windows 10 or higher, and its extensions directory covers integrations with local files, calendars, emails and messaging apps, with filesystem and iMessage among the current options [2]. You are adding capabilities one switch at a time to something that was already a chat window, and each switch is a decision you can review later.

The second is a sandboxed runner. Anthropic’s Cowork feature accesses local files directly without manual uploads, but runs in an isolated virtual machine on your computer with controlled file and network access [2]. The agent gets a machine. It is just not quite your machine.

The third is a terminal agent scoped to a project folder. Claude Code is the obvious example, and an editor such as Cursor sits in the same family, both of them connecting to the same protocol as the chat apps do [7]. These are bounded by directory rather than by feature toggle, which is a genuinely different shape and, for most work involving files, a safer one.

The fourth is a browser agent. ChatGPT Atlas is a browser built with ChatGPT at its core, launched worldwide on macOS, with agent mode released in preview to Plus, Pro and Business users [4]. Its surface is not your disk. Its surface is every site you happen to be logged into.

When someone on your team says “we should get a desktop agent”, make them say which of the four they mean. Naming it settles half the argument, because the four are not substitutes and the right answer is often two of them for different jobs.

Blast radius is the first filter, not the last

Ask four questions of any candidate, in this order: what can it read, what can it write, what can it execute, and what can it reach over the network. The vendors answer these in documentation, and the answers are more discriminating than any feature grid.

Claude Code publishes the clearest version of this. In its manual mode it starts with read-only permissions and asks before it edits files, runs tests or executes commands, while running a built-in set of read-only commands such as ls, cat and git status without asking [3]. Writes are bounded: in manual mode it can only write to the folder where it was started and that folder’s subfolders, and cannot modify files in parent directories without explicit permission [3]. Network access is treated as its own category, with commands that fetch content from the web such as curl and wget excluded from automatic approval by default [3]. That is four separate dials, and you can see where each one is set.

The same documentation describes the alternative. In auto mode, a separate classifier model reviews actions instead of you and blocks the ones it judges unsafe, with your explicit ask and deny rules still applying and your organisation able to turn auto mode off [3]. Which mode a session starts in depends on your plan, the surface you start it from, and your settings and your organisation’s [3]. This is a real trade and worth naming as one: you are exchanging your own review for a model’s review, in return for not being asked 40 times an hour. It is defensible on a scratch project and much less defensible on the folder holding client contracts.

For a browser agent the dial is different and blunter. OpenAI’s own suggestion is to use agent in logged-out mode to limit its access to sensitive data and the risk of it taking actions as you on websites [4]. That is the browser equivalent of pointing a terminal agent at one directory. It also tells you what the risk actually is, which is not the model doing something odd, but the model doing something ordinary while holding your session cookies.

The working rule is to give the agent the smallest surface that still lets it do the job, and to add to it only when a specific task fails for a specific reason. One project folder beats a home directory. A logged-out browser beats a logged-in one. A read-only connector beats one that can also write.

The connector layer is portable and the subscription is not

The Model Context Protocol is now the common plug. It is an open-source standard for connecting AI applications to external systems, and it is supported across Claude, ChatGPT, Visual Studio Code and Cursor, among others [7]. Its architecture separates hosts, which are the LLM applications that initiate connections, from clients, which are the connectors inside the host application, from servers, which are the services providing context and capabilities [8]. The current specification revision is dated 2026-07-28 [8].

The practical consequence is the most useful thing to know before you buy anything. If your business writes or configures an MCP server for its own database, invoicing system or document store, that server is not owned by whichever agent you happened to install this quarter. Switching agents means re-pointing configuration, not rebuilding the integration. The effort you spend on the connector layer survives the decision you are agonising over; the effort you spend learning one vendor’s interface does not.

That also deflates the usual comparison. Asking which agent connects to more tools mostly resolves to asking which one has more connectors already listed and one click away, because anything with a server can be attached to any of them with a little work. So compare the directories if you like, but treat the difference as hours of setup rather than as a capability gap.

Nobody is auditing what you connect

The soft assumption behind clicking install is that someone checked. Both major vendors say plainly that they did not.

Anthropic’s position is that it reviews connectors against its published listing criteria before adding them to its directory, but does not security-audit or manage any MCP server [3]. OpenAI’s is blunter still: it recommends that you do not connect to a custom MCP server unless you know and trust the underlying application, notes that such servers are not developed or verified by OpenAI and are third-party services subject to their own terms, and warns that any MCP server may receive sensitive data as part of querying [6]. The specification agrees from the other direction, stating that tools represent arbitrary code execution and must be treated with appropriate caution, and that descriptions of tool behaviour such as annotations should be considered untrusted unless obtained from a trusted server [8].

Underneath that sits the failure mode nobody has fixed. OpenAI describes prompt injection as an attack that embeds malicious instructions in content its models encounter, such as a webpage, with the intention of overriding ChatGPT’s intended behaviour [6]. On Atlas specifically, it says agents are susceptible to hidden malicious instructions that may be hidden in places such as a webpage or email, which could lead to stealing data from sites you are logged into or taking actions you did not intend, and states directly that its safeguards will not stop every attack that emerges as AI agents grow in popularity [4]. Anthropic runs its own mitigations, including a separate context window for web fetches and trust verification for first-time codebase runs and new MCP servers, and notes that this verification is disabled when running non-interactively with the -p flag [3]. Its own summary is that while these protections significantly reduce risk, no system is completely immune to all attacks [3].

Read those three statements together and the selection criterion writes itself. You are not choosing a product that has solved this. You are choosing how small you can make the overlap between what the agent can read from the outside world and what it can do to your own systems. An agent that reads a public webpage and can also send email from your account is one instruction away from a bad afternoon. The same agent with the mailbox disconnected is not.

You are probably already paying for one

The pricing turns out to be the least dramatic part of this decision, because the desktop agent is bundled into the plan you likely already hold.

On Claude, the free tier already lists desktop extensions and connectors through remote MCP, Pro is $20 per month or $17 per month on annual billing, and Max starts from $100 per month [1]. Team seats are $25 per month, or $20 on annual billing, with premium seats at $125 and $100 respectively; admin controls for remote and local connectors are listed under Enterprise rather than Team [1]. On the other side, ChatGPT Business standard seats are $25 per user per month or $20 per user per month billed annually, with premium seats at $125 and $100, and both seat types include ChatGPT Agent [5]. The two team tiers are priced identically at both levels [1][5], which is a useful thing to notice: price is not your tiebreaker, so stop treating it as one.

Data handling is the part of the bill that actually differs by tier rather than by vendor. OpenAI states that it will not train on your workspace’s data for Business [5]. Anthropic lists user control over data training preferences among its privacy safeguards, and says consumer users can change their privacy settings at any time [3]. Both shapes are defensible, but they are different defaults, and a desktop agent reading client files is exactly the case where the default matters. If the agent will touch anything covered by a client contract, the business tier is not an upgrade, it is the entry price.

One real job, one folder, and count the approvals

A demo task will only tell you what you already believed. Run a job you were going to do anyway this week, on one folder that contains real material, in whichever mode asks you the most questions.

Then measure two things. The first is how many approvals it asks for and whether you are still reading them by the end. If you find yourself clicking yes without looking, you have learned the most important fact available about how this will go in month three, and no vendor documentation will tell you that. The second is whether the job finished without you rewriting it. An agent that produced something you shipped has earned a seat; an agent that produced an impression has not.

Check the exit while you are in there. Removing an extension should be one switch, and credentials should be somewhere you can revoke. Claude Code stores API keys and tokens in the macOS Keychain when available and protects them with file permissions on Windows and Linux [3]. One detail is worth treating as a design signal rather than an inconvenience: when Claude Code is started directly in your home directory, trust acceptance is held for the current session only and is not written to disk, there is no setting to persist it, and the documentation recommends starting from a project subdirectory instead, where trust acceptance is saved per directory [3]. That is a vendor telling you, through friction, that pointing an agent at your entire home folder is not the intended shape of the product. Believe it.

What still goes wrong

Prices, plan names and feature boundaries move, and everything above is a snapshot dated in the header and cited to a vendor page you can check in a minute. That is the only defence available. Treat any figure quoted in a blog post, this one included, as a starting point rather than a fact.

The permission model is the part most likely to fail in practice, and it fails through you rather than through the software. Approval prompts get harder to read the more of them you see, and the vendors treat this as a design problem in its own right. Anthropic lists prompt fatigue mitigation among Claude Code’s built-in protections, in the form of allowlisting frequently used safe commands per user, per codebase or per organisation [3]. Handing review to a classifier is a reasonable trade for low-stakes work and a poor one for anything you would not want a stranger to do on your behalf, and the difficulty is that the same session often contains both. Nothing in this guide fixes prompt injection, because nothing currently fixes prompt injection; the vendors say as much in their own documentation [3][4]. The realistic goal is a small blast radius and a short list of things the agent can do that you would regret.

Finally, this procedure biases toward caution, and caution has a cost. If you are deliberately building deep automation on one platform and accept the lock-in as the price of getting good at it, the advice to keep every surface minimal will slow you down for no benefit. Know which of those two projects you are running before you start, because the discipline that protects a small business from an expensive mistake will also stop it from ever building anything ambitious.