Anthropic has introduced beta support for embedding endpoint detection and response sensors within Claude Cowork's local virtual machine, providing enterprise security teams with visibility into activities that traditional host-based sensors cannot monitor This article explores sensors cloud cowork. . Additionally, it works seamlessly with Claude Desktop connected to Amazon Bedrock, Google Cloud Vertex AI, or Microsoft Foundry.
However, coverage is limited to the local device: organizations cannot install their sensors on cloud Cowork sessions hosted on Anthropic's infrastructure.
Anthropic Adds Endpoint Detection and Response Monitoring Cowork executes shell commands and code within an isolated virtual machine. Installing a vendor sensor within the guest environment makes its activity visible to the security console organizations already use. At each VM startup, Claude Desktop copies the configured sensor package into the environment and verifies its signature against the approved key for the specified vendor.
Notably, its telemetry and data transfers can bypass Cowork's network allowlist, distinguishing between ordinary workload networking restrictions and security monitoring traffic. Approved vendors include CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne, and Tanium. Package signatures do not cover updates the sensor downloads later, and signatures expire within two years, necessitating the use of a newly signed package.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.
