Anthropic Enables EDR Monitoring in Claude Cowork to Detect Hidden AI Agent Activity
Anthropic's Claude Cowork integrates EDR sensors into its VM for enhanced AI agent activity monitoring.
Anthropic has launched a beta feature for Claude Cowork that allows businesses to run EDR sensors within its local virtual machine. This integration addresses a critical security gap by enabling visibility into shell commands and code execution that was previously hidden from host computer security software. The feature, available on Team and Enterprise plans for macOS and Windows, supports multiple EDR vendors and aims to provide security teams with better context for detecting AI agent activity.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CrowdStrike?
Get an email when a new story names CrowdStrike, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe launch of EDR sensor support in Claude Cowork highlights a previously overlooked security blind spot: AI agents executing shell commands and code inside local virtual machines were entirely invisible to host-level security tooling. Without this visibility, security teams had no way to detect malicious, anomalous, or policy-violating behavior initiated by AI agents on behalf of users. This matters because AI agents are increasingly granted broad system-level permissions, making them a high-value target for misuse or compromise. The absence of monitoring inside sandboxed AI execution environments represents a systemic gap as agentic AI use expands across enterprises.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security monitoring (SIEM)
Logs from everywhere end up in one place, with alerts that someone actually sees.