Anthropic has launched a beta integration allowing organizations to deploy endpoint detection and response sensors within the local virtual machine used by Claude Cowork. The new capability fills a monitoring gap where standard security software on a host computer cannot inspect shell commands or code execution occurring inside the isolated guest environment. By placing a sensor inside the virtual machine, teams can forward activity data directly to their established security consoles.
Visibility for isolated execution environments
Claude Cowork relies on a virtual machine to keep code execution separate from the host computer. While this boundary provides security, it also blocks the host endpoint detection and response (EDR) sensor from seeing what happens inside the guest system. The new integration gives security teams the visibility they need into automated actions that previously remained hidden from existing endpoint monitoring tools. This change arrives as AI tools increasingly interact with desktop environments, raising the need for better oversight of automated tasks.
The feature is currently available for Team and Enterprise plans on macOS and Windows systems. It also supports Claude Desktop when connected to Microsoft Foundry, Google Cloud Vertex AI, or Microsoft Bedrock. Anthropic specifies that this coverage applies only to local virtual machine sessions and does not extend to Cowork sessions hosted on its own servers.
Installation and vendor verification process
When the Cowork virtual machine starts, Claude Desktop copies a configured sensor package into the environment. The software then verifies the package signature against an approved key for the chosen vendor. If the signature is valid, Claude runs the installation script once during the startup phase. No sensor is installed if the configuration setting is disabled.
Anthropic has approved several vendors for this integration, including CrowdStrike, SentinelOne, Tanium, Palo Alto Networks, Neo, Pluto Security, and Evoke Security. Once active, the sensor connects to the vendor’s cloud platform to report telemetry. This data flow can bypass Cowork’s network allowlist, a detail that security teams must account for when reviewing outbound traffic.
Deployment requirements and management
Administrators must use Claude Desktop version 4.4212.0 or later to enable the monitoring. On Windows, the deployment requires the MSIX build, Windows 10 or 11, hardware virtualization, and the Virtual Machine Platform feature. Configuration is handled through registry policies on Windows, such as Intune or Group Policy, and mobile device management on macOS.
The installed sensor can access files, prompts, and Claude responses within the virtual machine. This data is sent to the EDR vendor rather than Anthropic, necessitating a review of vendor data handling policies. Anthropic advises customers to test the configuration before full deployment and after any updates to the sensor or Claude software.
Limitations and beta status
While removing management settings prevents the sensor package from running at future starts, it does not automatically uninstall a sensor that is already present. Package signatures remain valid for two years but do not apply to any updates the sensor downloads after its initial execution. Anthropic is not charging additional fees for the feature during the beta period, though individual EDR vendors may have their own costs.
The integration is distinct from previous research regarding sandbox vulnerabilities, such as a Windows attack chain that could lead to root access in the Linux sandbox. The monitoring feature provides local visibility rather than serving as a fix for such flaws or offering coverage for every type of Cowork session.
Licensed under CC BY-ND 4.0 International