Anthropic just closed one of the stranger blind spots in enterprise AI. When Claude's Cowork agent runs code on your computer, it does the work inside an isolated virtual machine — a sealed box that keeps the agent away from the rest of your system. Good for safety. But that same wall also kept your company's security tools out: the software watching for threats on employee laptops literally could not see what the AI agent was doing inside its box. On November 5, Anthropic shipped a fix.
What Anthropic announced
The update is a package of security and admin features for Claude Enterprise. The headline item is an Endpoint Detection and Response (EDR) integration, now in beta: admins can run their organization's own EDR sensor inside the Cowork virtual machine, so agent activity shows up in the same security console the team already monitors. It also adds a security center that pulls Claude's security settings for chat, Cowork, and Claude Code onto one page, generally available inference hooks, centralized management across an organization's Claude Enterprise and Claude Platform accounts, and new access controls.
How the EDR sensor works
When Cowork — or the unified Claude experience — runs shell commands and code locally, it executes them in a dedicated Linux VM, isolated from the host by the platform hypervisor (Apple Virtualization.framework on macOS, Hyper-V on Windows). The VM has its own network filtering and per-session isolation. The new beta lets admins deploy a vendor-signed sensor package inside that VM via device-management software. Seven vendors are approved so far: CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne, and Tanium. The sensors run in detection mode: they report activity, they don't block it. Requirements: Claude Desktop 4.4212.0 or later, Team or Enterprise plan, and on Windows the MSIX build with virtualization enabled.
The catch: the cloud is still a blind spot
Coverage stops at the laptop. Cowork sessions that run in Anthropic's cloud — where agents can keep working after an employee disconnects — cannot host your EDR sensor. Anthropic is explicit about that. There are two more honest caveats worth knowing: the sensor can inspect VM activity and content, including prompts, files, and Claude's responses, and its telemetry can leave the VM outside Cowork's network allowlist. Security teams gain visibility, but they should know exactly what the sensor can see.
Why it matters
AI agents are crossing from chatbots into doers — they run code, touch files, and act on their own. Every enterprise that deploys them hits the same question: who watches the agent? Anthropic's answer is to bring the existing security stack inside the agent's sandbox rather than asking teams to trust a black box. It is a small, unglamorous update — and exactly the kind of plumbing that decides whether AI agents get approved in big companies or stay stuck in pilot purgatory.
The agent era needs agent-grade security tooling. Anthropic just admitted its own isolation was hiding agent activity from the people paid to watch it — and fixed it. The cloud gap is the next thing to watch.
Comments
Post a Comment