Evaluation record · claude-cowork

Claude Cowork

v1.x (desktop GA; web/mobile with cloud execution in beta as of 2026-07-08)

Anthropic

Agentautonomousknowledge-workconsumersandboxed

Adequate

About This Agent

Anthropic's agentic workspace for non-technical knowledge work — 'Claude Code for the office.' Launched 2026-01-12 as a macOS desktop app that runs tasks in a sandboxed local VM (Apple Virtualization Framework with a custom Linux rootfs), expanding to web and mobile with cloud execution in July 2026. Turns natural-language goals into reports, spreadsheets, and organized files. Shipped with a disclosed prompt-injection-via-malicious-files risk that remains its central security tension.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

task completion accuracy

Assessment of real-world completion using Anthropic's published session analysis and independent launch reviews; built on the proven Claude Code agent harness

Evidence

TechCrunch - Claude Cowork expands to mobile and web — Analysis of 1.2M anonymized sessions across 600K+ organizations shows sustained production use: 33.4% business-process operations, 16.4% content creation, only 8.7% software development

mediumVerified: 2026-07-09

tool use reliability

Review of tool stack reliability across file, browser, document, and connector operations

Evidence

Claude Cowork product page — Mature toolset inherited from Claude Code: file manipulation, browser use, Office document generation, connectors (Slack, Google Drive, CRM), and MCP passthrough from the desktop app

mediumVerified: 2026-07-09

multi step planning

Evaluation of goal decomposition, parallel task execution, and long-horizon unattended runs

Evidence

Claude Cowork product page — Outcome-based instruction ('what you need, not how'), parallel work streams, scheduled tasks, and unattended execution that continues after the laptop closes

mediumVerified: 2026-07-09

memory persistence

Review of session continuity across desktop, web, and mobile plus workspace file persistence

Evidence

TechCrunch - Claude Cowork expands to mobile and web — Cross-device continuity: start a task at a desk, get status updates on the phone, retrieve output later; cloud execution keeps sessions alive with no device online

mediumVerified: 2026-07-09

error recovery

Inference from the shared Claude Code agent loop plus observed retry behavior; limited independent data for non-coding tasks

Evidence

PVIEITO - Inside Claude Cowork — Cowork is Claude Code running inside a VM orchestrated by Claude Desktop, inheriting its self-correcting agent loop; office-task failure modes are less publicly benchmarked than coding

lowVerified: 2026-07-09

agent collaboration

Review of sub-agent delegation and plugin/skill composition capabilities

Evidence

Claude Cowork product page — Specialized sub-agents handle end-to-end tasks; plugins bundle skills and workflows (brand voice, legal, finance)

mediumVerified: 2026-07-09

🛡️Security

tool sandboxing

Architecture review of the local VM isolation stack and cloud execution environments; strong containment of code execution, but the allowlisted Anthropic API endpoint has been demonstrated as an exfiltration channel

Evidence

PVIEITO - Inside Claude Cowork — On macOS, tasks run in a custom Linux VM (Ubuntu-based, ARM64) via Apple's VZVirtualMachine framework with VirtioFS folder sharing, bubblewrap and seccomp inside the VM, per-session sandbox users, and a network allowlist limited to package registries and Anthropic's API

Claude Help Center - Use Claude Cowork safely — Cloud sessions run in isolated temporary environments on Anthropic servers that cannot reach home/company networks; however isolation limits where code executes, not what Claude reads or does with granted access

highVerified: 2026-07-09

access control

Review of folder scoping, approval gates for destructive actions, and enterprise admin controls; consumer defaults rely on users choosing safe folders

Evidence

Claude Cowork product page — Users choose which folders and tools Claude can reach; deletions require approval; enterprise tier adds team-based permissions, spend limits, and per-department tool permissions

mediumVerified: 2026-07-09

prompt injection defense

Threat analysis of the untrusted-file-plus-consequential-action combination; score reflects a known, demonstrated exploitation path shipped at launch, partially offset by classifiers, training, and honest disclosure

Evidence

UC Strategies - Anthropic shipped Claude Cowork with a known security flaw — Prompt injection via malicious files was disclosed pre-launch (Johann Rehberger) and confirmed within 48 hours of the 2026-01-12 launch: a Word doc with 1-point white text made Cowork upload the user's financial documents to an attacker-controlled Anthropic account via the VM's allowlisted API

Claude Help Center - Use Claude Cowork safely — Anthropic documents mitigations (RL training to refuse injected instructions, classifiers scanning untrusted content, deletion protection) but names prompt injection the primary threat and calls agent safety 'an active area of development'; Claude in Chrome and unattended scheduled tasks widen the exposure

highVerified: 2026-07-09

data isolation

Review of per-session isolation within the shared VM and folder-scoped host access; cloud sessions are per-task and torn down at session end

Evidence

Claude Help Center - Claude Cowork architecture overview — One VM instance serves multiple conversations, with each conversation in its own isolated session (dedicated sandbox users, bubblewrap); only explicitly shared folders cross the VM boundary

mediumVerified: 2026-07-09

open source transparency

Source availability assessment; credit for published architecture documentation without released code

Evidence

Claude Help Center - Claude Cowork architecture overview — Proprietary product; Anthropic publishes unusually detailed architecture and safety documentation, but the agent harness, VM image, and classifiers are closed source

highVerified: 2026-07-09

🔒Privacy & Compliance

data retention

Review of Anthropic retention commitments applied to Cowork's session files across consumer and enterprise tiers

Evidence

Anthropic privacy policy — Consumer Pro/Max sessions follow Anthropic consumer retention terms; commercial tiers get training-exclusion defaults and retention controls. Cloud execution moves working files onto Anthropic servers for the session

mediumVerified: 2026-07-09

gdpr compliance

Compliance certification and DPA availability review under the Anthropic umbrella

Evidence

Anthropic Trust Center — SOC 2 Type II certified with GDPR-aligned DPA available for commercial customers; Cowork enterprise tier adds admin controls and OpenTelemetry activity streaming

mediumVerified: 2026-07-09

third party data sharing

Data flow analysis of model processing and opt-in connector traffic

Evidence

Claude Cowork product page — Processing stays with Anthropic (or customer-selected Bedrock/Google Cloud/Microsoft Foundry hosting); user-enabled connectors (Slack, Drive, CRM, email) move data to those services only when configured

mediumVerified: 2026-07-09

local deployment option

Deployment options assessment: local execution surface exists but model inference and cloud sessions require Anthropic's cloud

Evidence

Claude Help Center - Claude Cowork architecture overview — Desktop execution happens in a local VM on the user's machine, but Claude models are cloud-only and cloud execution runs entirely on Anthropic servers; no self-hosted or offline option

highVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness review including the dedicated safety and architecture articles

Evidence

Claude Help Center - Get started with Claude Cowork — Detailed help center covering setup, safety, and a published architecture overview of the VM isolation stack — unusually candid for a consumer agent

highVerified: 2026-07-09

execution traceability

Review of session visibility versus enterprise audit coverage; the audit-log gap lowers the score

Evidence

Claude Cowork product page — Live progress visibility and plan display before significant actions; enterprise OpenTelemetry activity streaming exists, but Cowork activity 'is not yet captured in audit logs or Compliance API'

mediumVerified: 2026-07-09

decision explainability

Assessment of plan previews, approval prompts, and progress narration

Evidence

Claude Cowork product page — Shows its plan and waits for approval before anything significant when permissions are enabled; deletions always require approval

mediumVerified: 2026-07-09

open source code

Open source assessment of the agent harness, VM image, and desktop app

Evidence

PVIEITO - Inside Claude Cowork — Closed-source product; internals are known mainly through third-party reverse engineering and Anthropic's architecture write-ups

highVerified: 2026-07-09

community activity

Adoption, release cadence, and public discussion volume analysis

Evidence

TechCrunch - Claude Cowork expands to mobile and web — 1.2M sessions across 600K+ organizations within ~5 months of launch; rapid platform expansion (macOS to Windows/Linux/ChromeOS, web, mobile) and heavy public analysis

highVerified: 2026-07-09

⚙️Operational Excellence

ease of integration

Onboarding friction assessment for non-technical users across desktop, web, and mobile

Evidence

Claude Cowork product page — Included in existing Claude Pro/Max subscriptions with no extra setup; desktop app installs the VM transparently; web and mobile need only a login

highVerified: 2026-07-09

scalability

Assessment of parallel sessions, cloud continuation, and subscription rate-limit behavior

Evidence

TechCrunch - Claude Cowork expands to mobile and web — Cloud execution (beta from 2026-07-07) runs parallel work streams that continue with no device online; five-hour usage windows cap sustained throughput

mediumVerified: 2026-07-09

cost predictability

Pricing model analysis; flat subscriptions cap spend but usage limits can throttle heavy work

Evidence

Claude Cowork product page — Flat subscription pricing: included in Pro ($20/mo) and Max ($100-$200/mo); no per-task metering, though Cowork consumes usage limits faster than chat

highVerified: 2026-07-09

monitoring capabilities

Monitoring and audit tooling review; consumer tiers have per-session visibility only

Evidence

Claude Cowork product page — Enterprise tier offers admin analytics, spend limits, and OpenTelemetry streaming, but Cowork activity is not yet in audit logs or the Compliance API

mediumVerified: 2026-07-09

production readiness

Maturity assessment weighing rapid adoption against beta surfaces and the launch security record

Evidence

TechCrunch - Claude Cowork expands to mobile and web — Six months old with fast iteration; web/mobile and cloud execution still in beta; launched with a known prompt-injection flaw, and enterprise audit integration is incomplete

mediumVerified: 2026-07-09

Strengths

+Real VM isolation on desktop: custom Linux VM via Apple's VZVirtualMachine with bubblewrap, seccomp, per-session sandbox users, and a network allowlist
+Built on the proven Claude Code agent harness, repurposed for office work with sub-agents, skills, and plugins
+Explicit folder scoping and approval gates: Claude can only reach folders the user grants, and deletions require approval
+Cloud execution (July 2026 beta) continues tasks across desktop, web, and mobile with no device online
+Unusually candid safety and architecture documentation, including named prompt-injection risks
+Flat subscription pricing included in Pro/Max removes per-task cost anxiety
+Massive early traction: 1.2M sessions across 600K+ organizations in ~5 months

Limitations

!Shipped 2026-01-12 with a pre-disclosed prompt-injection flaw: within 48 hours researchers showed a malicious Word doc (1-pt white text) exfiltrating financial documents via the VM's allowlisted Anthropic API
!The core tension is architectural: sandboxing limits where code runs, not what Claude does with folders and connectors it was granted
!Claude in Chrome, computer use, and unattended scheduled tasks each widen the injection-to-action surface
!Cowork activity not yet captured in enterprise audit logs or the Compliance API
!Web/mobile and cloud execution still beta with rollout gated by plan tier
!Consumes subscription usage limits quickly; five-hour usage windows interrupt long tasks
!Cloud-only models; no self-hosted or offline option

Metadata

license: Proprietary

supported models

0: Claude Opus

1: Claude Sonnet

deployment type: Desktop app (local VM execution) + web/mobile with Anthropic-hosted cloud execution (beta)

architecture: Claude Code harness inside a custom Linux VM (Apple Virtualization Framework/VZVirtualMachine on macOS; VirtioFS file sharing; bubblewrap + seccomp; network allowlist)

tool support

0: File and folder operations (scoped)

1: Browser use / Claude in Chrome

2: Office document, spreadsheet, and presentation generation

3: Connectors (Slack, Google Drive, CRM, email, calendar)

4: MCP passthrough, sub-agents, skills, and plugins

5: Scheduled tasks

first release: 2026-01-12 (macOS desktop, Max then Pro); web/mobile + cloud execution beta 2026-07-07

pricing: Included in Claude Pro ($20/mo) and Max ($100-$200/mo); Team and Enterprise tiers add admin controls

usage stats: 1.2M anonymized sessions across 600K+ organizations (late May 2026): 33.4% business-process ops, 16.4% content creation, 8.7% coding

Use Case Ratings

content creation

Core use case: drafts, presentations, proposals, and reports were 16.4% of observed sessions, with document/spreadsheet output as the default deliverable

data analysis

Spreadsheet reconciliation and report assembly dominate the top usage category (33.4% business-process operations)

research assistant

Web browsing plus connector access supports multi-source research organized into documents, with cloud sessions continuing unattended

code generation

Inherits the Claude Code harness and can code (8.7% of sessions), but Claude Code itself is the better tool for engineering work

Similar Agents

Claude Code

Anthropic

ChatGPT Agent Mode

OpenAI

Microsoft Scout

Microsoft

Manus

Butterfly Effect / Meta (acquisition being unwound as of June 2026)