Anthropic Enables EDR Security Monitoring for Claude Cowork AI Agents on Windows and macOS

What happened

Anthropic has launched beta support for running endpoint detection and response (EDR) sensors within Claude Cowork’s local virtual machine. Anthropic is an artificial intelligence company based in San Francisco, and its products and services include Claude and Claude Code. Apple is a software and consumer electronics company based in Cupertino.

This enhancement gives enterprise security teams visibility into AI agent activity that traditional host-based monitoring cannot detect. The new feature is compatible with Claude Desktop on both Windows and macOS for Team and Enterprise customers.

According to Anthropic’s deployment documentation , the integration also works with Claude Desktop connected to Amazon Bedrock, Google Cloud Vertex AI, or Microsoft Foundry.

It targets a specific visibility gap: Cowork executes shell commands and code inside an isolated VM, beyond the view of the computer’s existing EDR sensor. Anthropic EDR Security Monitoring Whenever the Cowork VM starts, Claude Desktop copies the configured vendor sensor package into the environment.

It verifies its signature against that vendor’s approved signing key. A valid package triggers the vendor’s installation script, which runs at most once per VM startup.

The VM typically starts when a user opens Cowork and remains active until Claude quits or the user signs out. Once installed, the sensor connects to its vendor’s cloud and reports activity to the security console defenders already use.