Anthropic has introduced a new beta feature allowing businesses to monitor activity inside Claude Cowork through endpoint detection and response (EDR) software, addressing a security gap because the platform runs code and shell commands inside a separate virtual machine (VM) that host security software cannot directly monitor. The integration lets businesses install EDR sensors inside the VM and send activity data to existing security platforms. It is available for Team and Enterprise customers on macOS and Windows, and supports Claude Desktop connected to Amazon Bedrock, Google Cloud Vertex AI, and Microsoft Foundry. When the VM starts, Claude Desktop copies the configured sensor package into the environment, checks its digital signature against the approved vendor’s key, and runs the installation script if verification passes; without configuration, no sensor is installed. Anthropic supports seven vendors: CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne, and Tanium. Businesses need Claude Desktop version 4.4212.0 or later; Windows users must have the MSIX version, Windows 10 or Windows 11, hardware virtualization support and the Virtual Machine Platform enabled. Administrators can configure the feature through MDM policies on macOS, while Windows deployments can use registry policies through Group Policy or Microsoft Intune. The integration only covers activity inside the local Cowork VM; sessions hosted on Anthropic’s servers are not included. Anthropic noted an installed EDR sensor may access prompts, files, Claude’s responses and other