A permissioned AI desktop agent is software that lives on your computer the same way iTunes used to — open in the background, one shortcut away, doing things in your real apps instead of only talking. The category quietly went mainstream in 2026: Microsoft put Recall on every Copilot+ PC, Anthropic gave Claude direct keyboard control of macOS in March, and Perplexity shipped a 24/7 mode that runs on a dedicated Mac mini. This post walks through what an always-on desktop AI agent actually is, the three different architectures shipping today, and what it looks like to use one across a real day.
What an always-on desktop AI agent actually is
A permissioned AI desktop agent is a piece of software that runs on your machine, has direct hooks into your operating system, and stays open while you work. Three properties separate it from a browser chatbot:
- Always one keystroke away. It lives in the dock, the system tray, or a menu-bar icon — not a tab you have to find. Anthropic's own download page emphasizes this: "The desktop app is always accessible from your dock and includes quick entry for instant access from anywhere in your system" (Anthropic, 2026).
- Hooks into the desktop. Accessibility APIs, file-system access, optional screen capture, sometimes the clipboard. The agent does not just produce text — it can act on what is on screen.
- Permission-based execution. Because it can act, it has to ask. The serious agents in 2026 all ship with a permission prompt model for anything sensitive.
This is the line that splits a desktop AI agent from a chat assistant. A chat assistant gives you a draft email; a desktop AI agent puts the draft into Mail and waits for you to hit send. Lapu AI sits on the agent side of the line, with permissioned local execution as the design center.
A desktop AI assistant, not a virtual pet
A quick disambiguation, because the word "companion" pulls in two very different things. This article is about a desktop AI assistant — a permissioned productivity tool that opens your files, drafts your email, cleans your spreadsheets, and asks before any sensitive action. It is not a virtual desktop pet, an animated character that wanders your screen, or a chatbot persona you talk to for company. Those exist, and some people enjoy them, but they do not act on your machine and they are not what this guide covers.
The distinction matters because the two categories have opposite design goals. A virtual-pet or character "companion" is built to be present and entertaining; it has no permission model because it does nothing consequential. A desktop AI assistant is built to do real work on your real files, so its entire design centers on the permission gate and the audit trail — the controls that make it safe to let software act on your behalf. If you came here looking for a screen pet, this is the wrong page. If you want a tool that does the work a junior assistant would, read on.
For the hardware side of running one — the kind of machine a desktop AI assistant actually needs — see the best desktop for AI computing tasks. For the product category itself, the desktop AI agent overview is the canonical starting point.
The three desktop-agent architectures in 2026
The category has split into three architectures, each with a different answer to "what is the agent allowed to do?"
| Architecture | Example | What it sees | What it touches |
|---|---|---|---|
| Passive observer | Microsoft Recall on Copilot+ PCs | Periodic screen snapshots | Nothing on your behalf |
| Cloud agent on a desktop | Perplexity Computer | Files you grant; runs in the cloud | Apps the cloud agent can drive remotely |
| Permissioned local actor | Claude Cowork, Lapu AI | Only what you point at, when you ask | Local apps via accessibility APIs, with confirmation prompts |
Passive observer. Microsoft Recall is the canonical example. According to Microsoft's own documentation, Recall "takes periodic snapshots of screen activity" and stores them locally — "Snapshots and associated data are stored locally on the device" with "no internet or cloud connections required" for the indexing (Microsoft, 2025). It does not act on your behalf. It is a memory layer for the future-you who wants to search "what was that diagram I closed yesterday?"
Cloud agent on a desktop. Perplexity Computer is the canonical example here. It is a Mac app, but the agent itself runs in Perplexity's cloud and reaches into your local files and apps through the local app. Perplexity recommends running it on a dedicated, always-on machine like a Mac mini — effectively turning a spare Mac into a 24/7 task runner. The model never directly executes on your laptop; the local app is the bridge.
Permissioned local actor. This is Claude Cowork, OpenClaw, ChatGPT Agent, Manus, Genspark, and Lapu AI. The agent code runs locally, drives the keyboard and mouse through OS-level accessibility APIs, and asks before doing anything destructive. Anthropic shipped Claude Cowork on March 23, 2026, exclusively on macOS for Pro and Max subscribers — Claude can "move the mouse, use the keyboard, navigate applications and complete tasks while you step away."
The architecture matters because each model exposes a different threat surface. A passive observer can leak history if someone gets local access. A cloud agent crosses the network with file context every turn. A permissioned local actor is only as safe as its permission prompts.
What the agent sees, and what it touches
The question to ask a desktop AI agent — before you install it — is two layers deep: what does it see, and what does it touch?
What it sees:
- Nothing until you ask. The strict default. Lapu AI follows this — the agent reads files, screenshots, or clipboards only when you give it a task that requires them.
- Active window on demand. The agent captures the foreground only when you trigger an action (think: keyboard shortcut to "ask about this").
- Continuous screen feed. Recall takes periodic snapshots automatically. Convenient for "search my past," but it means everything that appears on screen is indexed and retrievable.
- File system index. Some agents pre-index folders you grant access to, so they can answer "find the invoice from March" without a live scan.
What it touches:
- Read-only. It can quote what is on screen but not act on it.
- Confirmed write. It can click, type, save, or send — but only after a per-action permission prompt.
- Standing approval. You grant the agent blanket access to an app or folder, and it acts without further prompts.
- Background autonomy. It can drive your machine while you are away (Claude Cowork, ChatGPT Agent, Perplexity 24/7 mode).
This grid is where the real design decisions sit. The Microsoft Copilot page describes the assistant as one that "helps you design, chat, learn, and stay in sync" (Microsoft, 2026) — which is vague on purpose, because the actual capability set differs across Copilot's surfaces (web, app, Edge, in-Office, on-Windows). When you evaluate an agent, write down explicitly which row of the see/touch grid it lands on.
A day with a permissioned desktop agent
Here is what a single day looks like with a permissioned AI desktop agent — concrete examples, not aspirational marketing.
8:42 a.m. — inbox triage. You hit a global shortcut. The agent reads the open Mail window (with permission you granted at install), groups unread mail into "personal," "newsletters," "client," and "needs reply." It asks: "Archive the 14 newsletters?" You hit yes. Eleven seconds elapsed.
10:15 a.m. — research summary. You highlight three articles in browser tabs, then ask the agent to write a brief on a given topic. The agent takes screenshots of each tab, asks permission to read them, and produces a 200-word summary with citations to the original URLs. Nothing is sent to the cloud except the screenshots themselves; your file system is untouched.
12:30 p.m. — meeting prep. You ask: "Pull the last three emails with Acme and the notes from our 3 May call into a one-pager." The agent asks for permission to read Mail, your Notes folder, and to create a new file. You approve once, scoped to "this task." Forty seconds later there is a one-pager on your desktop.
3:00 p.m. — spreadsheet cleanup. You ask: "Fix the dates in column C — some are MM/DD, some are DD/MM." The agent reads the open Excel file, proposes a single regex-based transformation, shows you a 10-row preview, and asks for confirmation before writing. You confirm. Excel goes through 4,212 rows in under five seconds.
5:45 p.m. — audit trail. Before you sign off, you open the agent's audit log — every action it took today, every permission you granted, every file path it read, every prompt and tool call. Three minutes to skim. You see one action you do not remember authorizing; you click "revoke." The agent deletes the cached context and asks again next time.
That last point is where the design center of a serious desktop agent sits. The agent is not impressive because it can act — it is impressive because every action is reviewable.
How Lapu AI builds a permissioned desktop agent
Lapu AI is a desktop AI agent that ships as a permissioned desktop agent on macOS and Windows. The design follows three commitments.
Frontier model, local actor. The reasoning runs on Anthropic's frontier Claude models (and others you can configure). The acting runs on your machine. The model never directly touches files or apps — Lapu AI's harness does, after a permission check. The model picks the right tool; the harness owns the dangerous parts. The same separation that Anthropic describes for computer use applies here (Anthropic, 2024).
Permission per task, not per session. Each task starts with a fresh permission scope. "Read these three files." "Open Mail and archive newsletters." "Run this shell command." A standing approval is the exception, not the default — and every approval is logged so you can revoke it later.
Audit by default. Every action the agent takes lands in an audit log on your machine. The log records the prompt, the model's tool calls, the harness's executions, and the file paths or app actions touched. It is yours, locally, and not synced to a Lapu AI server.
The result is an agent you can leave running because you can always answer the question "what did it just do?" without guessing. Related: see the desktop automation tasks it runs day-to-day, and why time-pressed founders lean on a permissioned agent to offload routine work. If you are weighing it against Anthropic's own desktop tools, see how it compares as a Claude Desktop alternative.
FAQ
- What is a permissioned AI desktop agent?
- A permissioned AI desktop agent is an application that lives in your dock or system tray on macOS or Windows and works alongside the apps you already use — opening files, sending messages, filling forms, summarizing what is on screen — but asks before any sensitive action. It differs from a chat tab in two ways: it is always one keystroke away, and it can act on your machine instead of only producing text.
- How is a desktop AI agent different from a chatbot?
- A chatbot answers questions inside a web page. A desktop AI agent has hooks into the operating system — accessibility APIs, the file system, your apps. When you ask 'rename the screenshots from yesterday to match the meeting names,' a chatbot returns a script you copy and run; an agent runs it for you, after asking permission for the file-system access.
- Is a desktop AI agent the same as Microsoft Recall?
- No. Recall is a passive layer — it takes periodic screenshots of your screen and stores them locally on a Copilot+ PC so you can search your past. An active agent like Claude Cowork or Lapu AI does the opposite: it acts on your behalf when you ask. The two models can coexist, but they answer different questions ('what did I do?' versus 'do this for me').
- Can I use an AI desktop agent if I am on macOS?
- Yes. The major desktop-agent products ship for macOS first or alongside Windows: Claude desktop runs on macOS and Windows, Claude Cowork ships only on macOS at launch, Perplexity Computer is macOS-only, and Lapu AI runs on macOS and Windows. Linux support is the laggard — Claude explicitly lists Linux as 'not available' on its download page.
- Is a desktop AI agent safe?
- It depends on what the agent can do without asking. An agent that only reads files when you call it is low-risk. An agent that can click and type at will is much riskier — it is a target for prompt injection from content on your screen. The right defense, per Anthropic's own documentation, is a permission model with explicit human confirmation for sensitive actions and a complete audit trail of what happened.
- Does a desktop AI agent work offline?
- Partly. The frontier model itself usually runs in the provider's cloud — Anthropic, OpenAI, or Google — so a network connection is needed for new reasoning. But the agent application is local. Your files stay on your machine; only the prompt and the resulting actions cross the network. Some agents can fall back to smaller local models for basic tasks, with worse quality.
- How much does a desktop AI agent cost in 2026?
- Most desktop agents cluster around $20 per month for individual plans — ChatGPT Plus, Claude Pro, Perplexity Pro, and Lapu AI all start in that band, with higher tiers for heavier use. Features that require background agent runs (like Claude Cowork or Perplexity's 24/7 mode) tend to live in the higher tiers because they consume more compute.
Sources
- Introducing computer use, a new Claude 3.5 Sonnet, and Claude 3.5 Haiku — Anthropic (2024-10-22) · accessed 2026-05-20
- Download Claude — desktop apps for macOS and Windows — Anthropic (2026-05-13) · accessed 2026-05-20
- Privacy and control over your Recall experience — Microsoft (2025-04-18) · accessed 2026-05-20
- Microsoft Copilot for individuals — PC, Mac, and mobile — Microsoft (2026-05-01) · accessed 2026-05-20
