EN PT-BR
← Voltar ao feed
low

Anthropic adds beta EDR sensor support inside Claude Cowork's local VM on Windows and macOS

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 01:50 · coletado há 2 horas

Anthropic has launched a beta feature that lets enterprise teams run EDR sensors inside the local virtual machine used by Claude Cowork. The VM executes shell commands and code for AI agents, so the host's existing EDR sensor cannot see that activity. The feature is available to Team and Enterprise customers using Claude Desktop on Windows and macOS, including deployments connected to Amazon Bedrock, Google Cloud Vertex AI or Microsoft Foundry. It is a defensive product release, not a threat or incident.

Detalhes técnicos

  • Each time the Cowork VM starts, Claude Desktop copies the configured vendor sensor package into the VM and verifies its signature against the vendor's approved signing key. A valid package triggers the vendor's install script, at most once per VM startup. Nothing is installed without configuration.
  • Approved vendors: CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne and Tanium. Packages without an approved vendor signature are rejected.
  • Requirements: Claude Desktop 4.4212.0 or later. On Windows, the .msix build, Windows 10 or 11, hardware virtualization and the Virtual Machine Platform feature. Configuration is through macOS MDM or Windows registry policy (Group Policy, Intune).
  • Coverage is limited to the VM running locally. Sensors cannot be installed in Anthropic-hosted cloud sessions.
  • Sensors can inspect prompts, files, responses and other VM content and send it to their vendor outside Cowork's network allowlist. Anthropic says it neither receives nor controls that data. This matters where agent workflows expose credentials in logs, command arguments or transcripts.
  • Removing the management settings stops future package execution but does not uninstall an existing sensor. Package signatures do not cover updates the sensor downloads later, and they expire within two years, after which packages must be re-signed.
  • The telemetry complements the Claude Compliance API, which exposes supported conversations, files, transcripts and administrative events.

Remediação

  • Test the integration before deployment and after any Claude or sensor update.
  • Review the data-handling and privacy implications of vendor telemetry leaving the Cowork network allowlist.
  • Track the signature expiry (two years) and plan re-signing of packages.
  • Anthropic charges no extra fee during the beta, but sensor vendors may charge separately.

Linha do tempo

  1. gbhackers.com ↗ · pub. 03/11/2026 01:50 · coletado 03/11 02:00 primeiro registro

    Anthropic adds beta EDR sensor support inside Claude Cowork's local VM on Windows and macOS

    ler a análise desta fonte

    Anthropic has launched a beta feature that lets enterprise teams run EDR sensors inside the local virtual machine used by Claude Cowork. The VM executes shell commands and code for AI agents, so the host's existing EDR sensor cannot see that activity. The feature is available to Team and Enterprise customers using Claude Desktop on Windows and macOS, including deployments connected to Amazon Bedrock, Google Cloud Vertex AI or Microsoft Foundry. It is a defensive product release, not a threat or incident.

    Technical Details

    • Each time the Cowork VM starts, Claude Desktop copies the configured vendor sensor package into the VM and verifies its signature against the vendor's approved signing key. A valid package triggers the vendor's install script, at most once per VM startup. Nothing is installed without configuration.
    • Approved vendors: CrowdStrike, Evoke Security, Neo, Palo Alto Networks, Pluto Security, SentinelOne and Tanium. Packages without an approved vendor signature are rejected.
    • Requirements: Claude Desktop 4.4212.0 or later. On Windows, the .msix build, Windows 10 or 11, hardware virtualization and the Virtual Machine Platform feature. Configuration is through macOS MDM or Windows registry policy (Group Policy, Intune).
    • Coverage is limited to the VM running locally. Sensors cannot be installed in Anthropic-hosted cloud sessions.
    • Sensors can inspect prompts, files, responses and other VM content and send it to their vendor outside Cowork's network allowlist. Anthropic says it neither receives nor controls that data. This matters where agent workflows expose credentials in logs, command arguments or transcripts.
    • Removing the management settings stops future package execution but does not uninstall an existing sensor. Package signatures do not cover updates the sensor downloads later, and they expire within two years, after which packages must be re-signed.
    • The telemetry complements the Claude Compliance API, which exposes supported conversations, files, transcripts and administrative events.

    Remediation

    • Test the integration before deployment and after any Claude or sensor update.
    • Review the data-handling and privacy implications of vendor telemetry leaving the Cowork network allowlist.
    • Track the signature expiry (two years) and plan re-signing of packages.
    • Anthropic charges no extra fee during the beta, but sensor vendors may charge separately.