Claude's "Link to this computer": a bridge to your machine, not a blank cheque
Since October 2026, Claude Cowork tasks run in the cloud. "Link to this computer" is the bridge from that sandbox to your files, browser, and apps — if you know what it opens, what breaks it, and what it does not do.
On 6 October 2026, Anthropic drew a line: new Cowork tasks on Pro and Max run in the cloud. The Only on your computer toggle is gone. Close the laptop and the session keeps going. That is a real win — and it leaves a gap.
How does an agent running on Anthropic's servers read a folder on your disk, drive Chrome, or click through an internal app that has no connector?
The answer is not “Claude has your computer.” The answer is Link to this computer.
It is a per-session pairing, not a permanent takeover. Most people click it too late, too broadly, or mix it up with three other features that sit next to it in the UI. Here is the mental model I use — and the rules I set before I open the bridge.
What it is (and what it is not)
Link to this computer binds a cloud session to the Claude Desktop app running on this machine. Once the bridge is up, the session can request files, local tools, and — if you allowed it — the browser or application control. Every local call is checked against the permissions you already granted.
It is not:
- the
claude://URL scheme, which merely opens Desktop from a link or a script; - computer use, the Pro/Max preview that clicks and types on screen like a human;
- a fully local session (new Pro/Max Cowork tasks no longer run that way; for that, use Claude Code Desktop).
The usual mix-up: “I linked my computer, so Claude is on my machine.” No. Claude reasons and runs code in an isolated cloud sandbox, created for that session and destroyed when it ends. Desktop is only the bridge. If Desktop is closed, the bridge does not exist.
The mental model: two worlds, one bridge
Picture two environments that cannot see each other by default.
[ Anthropic cloud session ] [ Your computer ]
agent loop attached folders
code execution local MCP servers
account files built-in browser
connectors (Slack, Drive, …) computer use
\ /
\ Claude Desktop (bridge) /
\__________________________/
Anthropic-brokered connection
(bridge.claudeusercontent.com)
The cloud sandbox:
- cannot reach your LAN, internal addresses, or cloud metadata;
- holds only short-lived, session-scoped tokens;
- never receives connector authorization tokens — those calls stay server-side.
When the session needs something on your machine, the request goes through Desktop. Anthropic is explicit: if the app is closed or offline, the cloud session keeps running, but it cannot reach the device.
That is the same pattern as a remote agent with a local runner: the brain is elsewhere, the hands are here, and the tunnel is explicit.
How to link a session, step by step
- Install or update Claude Desktop (macOS or Windows; Linux is still in beta, and the bridge is more brittle there).
- Open the app, sign in, leave it running. Closing the window or letting the machine sleep drops the bridge.
- Start a task — from Desktop, claude.ai, mobile, or the Chrome side panel. Since 16 September 2026, Chat and Cowork are merging: if the selector is gone, just describe the outcome you want.
- Attach only the folders the task needs. Desktop will ask for consent, even for a folder you already marked as trusted.
- In the task, choose Link to this computer.
- If you want Claude to click inside apps: Settings → General (Desktop app) → Enable computer use. That is a Pro/Max preview, separate from file linking. Team and Enterprise do not have it yet.
One operational detail most guides skip: the set of local MCP servers is snapshotted at link time. Adding, enabling, or reconfiguring an MCP mid-session does nothing. Fully quit Desktop, relaunch, then re-link the task — or start a new one, which is usually faster.
What the bridge unlocks
Once linked, and only while Desktop stays open:
Local files. Claude reads and writes in folders you explicitly connected. Originals stay on disk. When the task needs a file in the cloud, Desktop fetches a copy; those copies follow Anthropic's retention policy and go away when you delete the session.
Local MCP servers and plugins. They run on your machine, not in the sandbox. A cloud session does not embed your local MCPs. If MDM sets isLocalDevMcpEnabled to false, the bridge keeps only the folder-limited file tools.
Browser. By default, Desktop's built-in browser (rolling out), or your own Chrome via the extension if that is your preferred browser. You can steer it from web or mobile while Desktop stays open. Reading the current tab in the Chrome side panel does not need Desktop.
Computer use (Pro/Max beta). When no connector or browser fits, Claude can open an app, click, and type. It asks permission per application. Some apps (trading, crypto) are blocked by default. There is no sandbox between Claude and the screen: it takes screenshots to orient itself. On macOS 15+, it works in the background by default and does not steal the pointer.
Anthropic's preference order is the right one, and I stick to it: connector first, browser second, screen interaction last. Slack through a connector takes seconds; Slack through clicks takes minutes and fails more often.
What breaks the bridge — and what does not
| Event | Cloud session | Local access |
|---|---|---|
| Web tab or mobile app closed | Continues | Unchanged if Desktop is open |
| Claude Desktop quit | Continues | Cut. Re-link. |
| Computer asleep | Continues | Cut. |
| MCP added without relaunching Desktop | Continues | The old tool set stays frozen. |
| Scheduled task with no local files | Runs even if the PC is off | Does not need the bridge. |
| Scheduled task with local folders | Runs in the cloud | Requires Desktop open at run time. |
This is the production gotcha. A scheduled task that “reads the Finance folder on my Mac” did not become magically autonomous on 6 October. The cloud made autonomous the work that lives in connectors and account files. Anything that touches the disk still needs a machine that is awake, an app that is open, and a live link.
The security rule I set before I click
A disk bridge is a tunnel. Size it like a VPN: explicit, bounded, observable.
- A dedicated working folder, never the home directory, never all of
Documents/, never a business network share. Create~/Claude-workspace/(or the Windows equivalent), put sources and deliverables there, and attach only that. - Least privilege per session. Link when the task actually needs the files, not “just in case.”
- Computer use = a blocklist. Banking, health, HR, password managers: blocked. Do not lean on model guardrails — they exist, they are not absolute.
- Manually approve while you are learning the flow, or whenever the task touches something irreversible (send, pay, delete). Deletion protection itself cannot be turned off: Claude always asks before permanently deleting a file.
- Prompt injection. As soon as Claude reads content outside your trust boundary (the web, email, a third-party PDF) and has write tools, an attacker can hide instructions. Shrinking either surface is often enough. The bridge widens both if you attach too much and turn on computer use.
- At work. Connecting a local folder makes that folder reachable from a cloud session. On an MDM-managed laptop, that is a governance decision, not a UI convenience. Team/Enterprise admins can require a trusted device, disable local MCPs, and stream Cowork events (Compliance API, OpenTelemetry).
Last, and non-negotiable: you remain responsible for actions taken in your name — messages sent, files changed, clicks inside your apps. An agent is not an anonymous intern.
Troubleshooting: the three banners you will see
“Couldn't link this session to a computer, so attached folders can't be used.” Desktop failed to sign / attest the pairing. Common causes: the app was updated but not fully relaunched, the session was opened from the web with Desktop not actually running, the machine is asleep, Linux beta (local VM / enclave key), or a managed Mac whose Secure Enclave refuses to sign outside an interactive session.
“This task can't be linked to this computer right now.” Often a stuck pairing state on the server, not your Wi-Fi. The bridge.claudeusercontent.com endpoint can answer (HTTP 426 = Upgrade Required, normal for a WebSocket bridge) while the pairing channel itself is jammed. Relaunch Desktop, start a new task, and if it persists: in-app feedback — several GitHub tickets only unblocked after Anthropic reset pairing server-side.
Folders look attached, but Claude cannot see them. You accepted the consent UI; the bridge tools (device_list_dir, device_stage_files, device_commit_files, device_bash) are missing from the session. Same family: the link never really established. Quit Desktop for real (Cmd+Q / Quit, not just the window close), sign back in, re-link.
Short checklist before you file a ticket:
- Claude Desktop is current, fully quit, then relaunched.
- Computer is awake, session unlocked.
- The task was re-linked, or you started a new one.
- One account, no shared logins (unsupported).
- If MCP is involved: re-link after every config change.
When you do not need to link
This matters as much as the how-to.
Leave the bridge closed if the task lives in connectors (Slack, Google Workspace, Microsoft 365, Salesforce), in Claude account files, or in a fully cloud scheduled task. Web and mobile are enough. You gain mobility, you shrink the attack surface, and you are not hostage to an open laptop.
Link when the deliverable is on disk: tidy a folder, produce a workbook next to the sources, drive an internal tool with no connector, or (Pro/Max) act inside a desktop app.
And if the work must not leave the machine — secrets, restricted code, data your CISO will not have processed at Anthropic — do not link. Use Claude Code Desktop, where the agent loop and history stay local. A file opened through the bridge is processed on Anthropic's servers, even if you never “uploaded” it by hand. That is the 6 October trade-off, not a footnote.
The question to ask before you click
“If this bridge stays open while I grab a coffee, what is the worst thing Claude can read or do with the folders and apps I have allowed?”
If the answer makes you uneasy, tighten the folder, block the apps, switch to manual approval. Link to this computer is not a UX detail. It is the moment a cloud agent gets hands on your workstation.
Treat it as an architecture interface — not a checkbox.
Rolling out agents with workstation access and want the guardrails in place before the first incident? Let's talk.