Claude Cowork can now run your EDR sensor inside its VM
Anthropic lets seven security vendors, including CrowdStrike and SentinelOne, install their endpoint sensors in the local VM that Cowork spins up, so agent sessions show up in your existing security tooling.
Anthropic now lets you run an endpoint detection and response sensor inside the local virtual machine that Claude Cowork creates on your computer. When the Cowork VM starts, Claude Desktop copies your vendor’s sensor package into it and checks its signature against an approved key, so the sensor can watch and report on what the agent does from inside the session.
Seven vendors are approved so far: CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne and Tanium. It is in beta for Team and Enterprise plans, on Claude Desktop for macOS and Windows (build 4.4212.0 or later), including Desktop connected to Bedrock, Vertex AI or Microsoft Foundry. Anthropic isn’t charging extra for the integration during the beta, though your EDR vendor might. On the same day, CrowdStrike announced its own Falcon Guardian piece of this, giving Cowork agent sessions the same detection and response coverage as the rest of a company’s Falcon-monitored estate.
Why it matters: if your organisation runs EDR and is piloting Cowork for agentic work, you no longer have to choose between the two or bolt on monitoring after the fact. The agent’s VM now shows up in the same console as every other endpoint.
The caveat: this only covers the local VM on your own machine. Cowork tasks that run in Anthropic’s hosted cloud VM get no EDR sensor at all, so a security team still has a blind spot for anything offloaded to the cloud.