Atticus Adds Mac Voice Control to Anthropic’s Claude
The MIT-licensed app combines Apple’s on-device speech recognition, Claude Code and reusable commands, with separate safeguards for consequential actions.
Listen
AI narration
10:47
0:00 / 10:47
AI SummaryGenerated from this article
Atticus, an MIT-licensed Mac app, adds voice control to Claude by combining Apple's on-device speech recognition with desktop automation. Users hold Control-Option-Space to speak requests that arrange windows, search files, read screen content and draft replies. The app connects to Claude through a paid Pro or Max plan without requiring a separate API key. Simple commands bypass Claude entirely, while complex requests invoke Claude Code's interface. Apple handles speech recognition locally, but Claude-backed reasoning occurs remotely. The project documents safeguards for consequential actions, though these are creator-reported capabilities rather than independently verified benchmarks. macOS 26 or later and a Claude subscription are required.
Hold Control-Option-Space, speak a request, then release. According to its documentation, Atticus can arrange windows, search file contents, read what’s on screen and type a reply into the active app. It connects those desktop tasks to Anthropic’s Claude through a paid Pro or Max plan, without requiring a separate Claude API key.
Atticus goes beyond a conventional voice chatbot by acting on the Mac. A request can become a window-management operation, a search or a reusable shortcut. Built-in actions can run without AI; more involved requests use Claude Code’s headless claude -p interface. Apple handles speech recognition on-device.
Atticus offers a concrete route into voice-driven desktop agents, though “local” needs qualification: microphone processing is local; Claude-backed reasoning is not. The documented capabilities also aren’t independently established reliability results.
Simple Commands Skip Claude Entirely
Atticus separates requests into two broad execution paths. Supported commands such as opening apps or websites, moving windows, searching the web and controlling music use built-in handlers that bypass Claude. Recognized speech triggers ordinary automation operations without model-generated decisions.
This approach affects both responsiveness and usage. Opening an application doesn’t inherently need a language model to plan the task, so Atticus reserves Claude for requests that require interpretation or a more complicated sequence.
The project also documents learned shortcuts. Its example, “When I say focus mode, close Slack and open my to-do list,” associates a phrase with a sequence of actions. Supported actions can then execute again without another AI call.
The README illustrates reusable shortcuts for operations such as opening apps, moving windows and playing music. It does not establish that every arbitrary desktop workflow becomes a dependable, model-free routine.
For Claude-backed requests, Atticus invokes claude -p, using Claude Code as the connection to the user’s existing plan. The app is free and MIT-licensed, but the required Claude subscription is not. “No API key” should not be read as unlimited AI usage or an entirely free service.
The creator publishes speed and cost estimates, including comparisons between initial AI-assisted actions and subsequent shortcuts. These are project-reported measurements, not independently reproduced benchmarks. API-rate equivalents also should not be mistaken for the actual billing terms of a Claude subscription.
Window Layouts, File Searches and Drafted Replies
Work with Zeniteq
Let’s work together
We’re open to thoughtful collaborations with teams building in AI. Explore the ways we can work together.
The documented workflows cover several kinds of desktop work, with different dependencies and consequences.
One example asks Atticus to place a code editor on a large display, with Chrome and Terminal on the laptop screen. Another searches for notes about a trip by their contents, without requiring an exact filename.
Screen-related requests include asking what is wrong with visible code or requesting a short summary of an article. The user can refer to material already open instead of manually copying it into a chat window.
For communication, the project documents a deliberately limited action: dictate a reply and Atticus types it into the app currently in use. The README says it does not send that reply, leaving the user an opportunity to inspect the text and recipient before committing.
Media control and saved spoken shortcuts fill out the routine end of the feature set. Optional Peekaboo integration adds the ability to click inside applications.
Sharing a voice interface does not make these capabilities equally dependable. Opening a known app is simpler than correctly interpreting an unfamiliar screen and manipulating its controls. Screen and application control also depend on macOS permissions, the available automation components and the user’s configuration.
A sensible first workflow is small and observable: open an app, position a window, then try a saved routine. More consequential actions deserve a separate assessment.
Speech Stays on the Mac, but the Agent Is Not Offline
Atticus says it uses Apple’s on-device speech recognition and that recorded audio never leaves the Mac. No separate speech API subscription or key is required, and the voice-recognition stage does not need an external transcription service before the request reaches Claude.
The whole assistant is neither private nor offline, however. Claude-backed requests still leave the local execution path, and tasks involving screen content or files deserve the same scrutiny as other AI workflows involving sensitive material. Keeping audio local does not guarantee that every part of a task remains on-device.
The shortcut behavior documentation distinguishes between provisional and finalized speech. AI reasoning can start during a pause, but AI tools and learned shortcuts wait for Apple’s final transcript. If finalization takes too long, Atticus offers the partial text for review. This helps protect against acting on words the recognizer later revises.
An exception is worth checking in Settings: supported instant commands can execute while the user is still talking when both “Instant commands” and “Act while I’m talking” are enabled. Users who prefer a deliberate release-to-act interaction should examine those options instead of assuming every action waits.
Confirmation Gates and the Sandbox Protect Different Things
Atticus describes safe mode as running AI commands inside Claude Code’s sandbox, with writes restricted to a scratch folder. It also says it asks before actions that delete, send, buy or change a file.
Additional documented command blocks include rm, sudo, disk tools and shutdown. The project says exact commands appear in the request log.
Each protection serves a different purpose. A sandbox restricts what an executing process can reach; a confirmation gate lets the user approve an intended consequence; a command log makes an action inspectable afterward. None substitutes for the others.
Anthropic’s Claude Code sandbox documentation qualifies the scope: the sandbox covers shell commands and their child processes, not every Claude Code tool or integration. Built-in file tools, MCP servers and hooks run outside that shell boundary and follow other controls.
Anthropic also documents broad default read access for sandboxed commands unless it is narrowed through configuration. Restricting writes does not automatically prevent an agent from reading sensitive files.
This does not establish a defect in Atticus. Its scratch-folder write restriction should nevertheless not be interpreted as complete isolation of the assistant, its data access and its desktop automation.
For anyone building a similar agent, the useful implementation lesson is the layering: validate the transcript, restrict execution, require approval for consequential actions and retain an understandable log. Desktop permissions remain another boundary to review separately.
macOS 26 or later, for the Apple speech functionality Atticus uses.
A paid Claude Pro or Max plan.
Claude Code, which the setup window can install and help sign into.
Apple’s command-line tools.
Optional Peekaboo integration for clicking inside apps.
Apple’s command-line tools can be installed with:
xcode-select --install
The repository provides a Terminal installer that checks the Mac, downloads the project into ~/.atticus, builds ~/Applications/Atticus.app and opens it. Reviewing that installer before running it is prudent, particularly for software that will receive desktop-control permissions.
On first launch, Atticus checks the Claude setup and requests macOS permissions. It then lives in the menu bar, with settings for the shortcut, model, screen behavior, memory and usage, among other options.
The README says startup at login and automatic updates are enabled, with controls to disable them. Users who want to review changes before an automation tool gains new behavior should check those settings.
A press-to-toggle recording mode is also available. Esc cancels listening without submitting the request, while pressing the shortcut during an answer stops the response or spoken playback. These controls make the interface more manageable without changing the underlying permissions granted to it.
The Strongest Idea Is Using Less AI
Atticus is most compelling where it avoids repeatedly asking Claude to solve a task that already has a known answer. Local transcription, deterministic command handlers and reusable shortcuts can keep routine desktop actions out of the model loop.
The MIT license makes that design available for inspection and adaptation. The repository is also a more useful starting point for evaluating the project than its brief circulation on discussion sites; there is no independent evidence here establishing broad reliability.
For Mac users who already pay for Claude, Atticus offers a documented way to try voice-driven agent control without adding a separate speech service. The sensible test is whether a few specific routines work consistently, with permissions and approvals that remain understandable. Success on those routines would be more meaningful than the breadth of commands an assistant claims it can attempt.
