Anthropic’s updated guidance now documents beta support for endpoint detection and response (EDR) sensors inside Claude Cowork’s local virtual machine, allowing enterprise security teams to monitor shell commands and code that host-based sensors could not see. The feature is available to Team and Enterprise customers using Claude Desktop on macOS and Windows, as well as supported Amazon Bedrock, Google Cloud Vertex AI and Microsoft Foundry configurations, according to the Claude Help Center.
Cowork runs code and shell commands in an isolated VM on the user’s computer. Under the integration, Claude Desktop copies an approved EDR vendor’s sensor package into the VM at startup, verifies its signature and runs the vendor’s installer so activity is reported to the organization’s existing security console. The beta supports sensors from CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne and Tanium.
The integration covers only local Cowork VMs; cloud-hosted sessions remain outside endpoint sensor coverage. Anthropic says sensors can inspect activity and content inside the VM, including prompts, files and Claude’s responses, and send telemetry to the EDR provider. Anthropic says it does not receive or control that data.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Claude Cowork Adds Beta EDR Monitoring Inside Local VM
SIGN UP FOR NEWSLETTERS
Please confirm your email address.
Sign up for cybersecurity newsletter and get latest news updates delivered straight to your inbox. You are also consenting to our Privacy Policy and Terms of Use.