What ChatGPT and Claude Desktop client apps ask of your computer
Published on 12th November 2026
Estimated Reading Time: 8 minutes
ChatGPT and Claude both offer desktop applications that go well beyond a chat window, with features that can read a screen, type and work with local files. Each of those abilities depends on operating system permissions, so what the two programs request on macOS, Windows and Linux says a good deal about their security and privacy trade-offs. A comparison follows of their baseline behaviour, the permissions that optional features unlock, their sandboxing approaches and the controversies that have surfaced so far.
Where the Desktop Apps Begin
The first of those comparisons is baseline behaviour, meaning what each application needs just to run. Very little is required to launch either one as a native program, and the real requests arrive only when optional agentic features are switched on.
On macOS the ChatGPT client is a regular, non-sandboxed program, which is hardly a surprise given that it is distributed only through OpenAI's website and so is not bound by the sandboxing rules that apply to Mac App Store software. Claude appears to be in the same position, since a bug report that inspected the app's entitlements found no App Sandbox entitlement on either Claude Desktop or the Claude Code bundled with it. Like any non-sandboxed native application, each can see its own data files and the user's home directory without a special prompt.
Computer Use and Its Two Permissions
The most visible optional feature is computer use, where the AI reads the screen, moves the mouse and types. On macOS, both ChatGPT's Computer Use and Claude's computer use need the same pair of grants, namely Screen Recording, so the model can see the target app and Accessibility so it can click, type and navigate. Neither is requested at install time, since ChatGPT asks once the Computer Use plugin is set up and Claude asks the first time it tries to use the machine.
Windows differs from macOS here. The ChatGPT documentation lists no Windows system permissions for the feature and instead tells users to keep the target app visible on the active desktop while a task runs.
Linux has no equivalent yet. The ChatGPT desktop app for Linux is in preview, and its Linux documentation says Computer Use is not yet offered there, with support due in a future release. Claude is in the same position, since its Linux installation guidance lists no computer use among the limitations of the beta.
Integrations That Ask for More
Beyond those two grants, each integration brings its own demands. ChatGPT's Apple Messages integration, which arrived on 20th August 2026, needs Full Disk Access, access to contact names and Automation permission before it can read or search message history. It works in ChatGPT Work and Codex on Apple Silicon Macs, and sending a message needs the user's approval by default.
Claude's equivalent friction comes from protected folders. Reports such as this Claude Code bug report show macOS prompting for the Desktop, Documents, Downloads and iCloud Drive locations, which means a project kept in one of those folders will be blocked until the user grants access.
Approval Modes and Sandboxes
Both applications also separate what the AI may attempt from what the operating system will allow. In ChatGPT, Ask for approval pairs a workspace-write sandbox with manual prompts, and it matches the default approval behaviour. The alternative, Approve for me, keeps the same sandbox but routes eligible requests through automatic review instead of a manual prompt. On macOS, the enforcement comes from the built-in Seatbelt framework, and the selectable profiles include read-only, workspace-write and custom configurations.
Claude uses Seatbelt on macOS too, as its sandboxing documentation explains. Moreover, it adds rule-based controls, with file system allow and deny lists plus a network proxy whose list of permitted domains starts empty. Those sandbox rules sit apart from the permission modes, which decide whether each tool call runs at all, and settings such as allowManagedDomainsOnly let a managed deployment tighten the network side further.
Sandboxing Beyond macOS
On Windows, OpenAI documents a native sandbox with two modes. The preferred elevated mode uses dedicated lower-privilege sandbox users, file system boundaries, firewall rules and local policy changes, and its setup requires administrator approval even though the commands themselves run without administrator privileges. The unelevated fallback runs commands under a restricted token from the current user, with weaker network isolation, and is positioned for cases where administrator-approved setup is blocked. Enterprise administrators can use requirements.toml to allow only the elevated mode.
Claude is less well covered on native Windows. The same sandboxing documentation says the Claude Code sandbox runs on macOS, Linux and WSL2, so on native Windows commands run outside a sandbox unless Claude Code is run inside a WSL2 distribution. WSL1 is not supported because bubblewrap needs kernel features that only WSL2 provides.
On Linux, both products rely on bubblewrap. ChatGPT's sandbox documentation says it must be installed first, that the bundled fallback helper needs unprivileged user namespace support, and that Ubuntu 24.04 may need an extra AppArmor profile before it works. Claude Code needs bubblewrap and socat, and by default it shows a warning and carries on without a sandbox when a dependency is missing, unless sandbox.failIfUnavailable is set to true.
The Browser Extension Controversy
The sharpest difference between the two is a report published by The Register on 20th April 2026. It described Claude Desktop for macOS writing a Native Messaging manifest called com.anthropic.claude_browser_extension.json, which pre-authorises three Chrome extension identifiers, including the Claude in Chrome extension, to run a local binary. The file was written for Chromium-based browsers even when the user had not installed them.
Privacy consultant Alexander Hanff called the behaviour a dark pattern and spyware, and argued that it breaches Article 5(3) of the ePrivacy Directive, which requires clear disclosure and consent unless access is strictly necessary for a requested service. Security consultant Noah Kenney disputed the spyware label and described the file as a dormant integration layer, although he still considered the risk real. Anthropic did not respond to The Register's request for comment.
Friction on the ChatGPT Side
ChatGPT has not drawn the same scrutiny, but it has had its own awkward moments. In July 2026, one user complained that an update led the assistant to reveal a full local directory path without any grant, although other users replied that any Mac app can see such paths and that the assistant was probably running ordinary file-listing commands.
Repeated macOS prompts about access to data from other apps are a documented annoyance too, though the traceable case concerns Claude. A report against the Claude Code desktop app describes a repeated file search that triggers the "access data from other apps" prompt over and over.
Windows Installation and Quirks
On Windows, the installer story is better documented for Claude. Its Windows deployment guidance says administrator privileges are required for a full-featured installation including Cowork, with users seeing a UAC prompt, while those without admin rights can still install Claude without Cowork. ChatGPT's elevated sandbox setup also needs administrator approval, as described above, although no installer-wide requirement is stated for it.
A bug report describes a Claude computer use permission card that offers only a Deny option, and a Windows user confirmed it there as well. Whether a reboot clears it is not established, so it is best treated as a quirk rather than a firm rule.
Linux Support Arrives for Both Apps
Anthropic released Claude Desktop for Linux in beta on 30th June 2026, as reported by Basic Tutorials. It supports Ubuntu 22.04 or later and Debian 12 or later on x64 and arm64, and the recommended installation through Anthropic's apt repository means updates arrive with the regular system updates, whereas a directly downloaded .deb file does not receive them. The documented limitations include no computer use and no dictation, and Cowork on Linux needs KVM virtualisation, QEMU packages, about 25 GB of free disk space and at least 8 GB of RAM.
OpenAI followed on 11th August 2026 with a preview of the ChatGPT desktop app for Linux, according to Gigazine. The supported distributions are Ubuntu 24.04 LTS and 26.04 LTS, Debian 13, Fedora 43 and 44, and current, fully updated Arch Linux, each on x64 and ARM64. Native Wayland support is described as experimental, so window positioning, focus and keyboard shortcuts may not fully work.
Auditing ChatGPT and Claude Permissions Before Granting Them
Both applications follow the same principle of opt-in escalation, where the base client runs with ordinary user privileges and each extra capability needs an explicit operating system grant. That keeps control with the user, but once permission is granted the AI gains a powerful automation surface that a compromised model or an injected prompt could misuse.
A short routine keeps things tidy. Decide first whether computer use is really needed because leaving it off removes the Screen Recording and Accessibility grants entirely. Then review the apps holding always allow status and any folder permissions for Documents, Desktop and Downloads, trimming each to the smallest sensible set, and keep both applications updated so that permission fixes and clearer consent prompts reach users. On Windows and Linux, confirm as well that the sandbox is actually active because Claude Code runs commands without one on native Windows and, by default, when its Linux dependencies are missing.
Treating each prompt as an ongoing conversation rather than a one-off decision is the habit worth building. Every capability enabled widens the AI's reach into the system, so the periodic audit matters as much as the first grant.
Please be aware that comment moderation is enabled and may delay the appearance of your contribution.