A vendor-neutral, technical breakdown of how Claude Cowork is isolated, what it actually costs, and the four boundaries that decide whether it fits your workflow.
What is Claude Cowork in plain terms?
Claude Cowork is Anthropic’s desktop AI agent that takes the autonomous, multi-step engine behind Claude Code and aims it at non-technical knowledge work: you point it at a folder, describe an outcome in plain language, and it plans and executes the task by reading, writing, and running code on your behalf. If you have ever wondered what is Claude Cowork beyond the marketing, the honest answer is that it is Claude Code wearing a friendlier face, wrapped in a hardened local sandbox, and metered on your subscription.
Anthropic introduced Cowork as a research preview in January 2026 and moved it to general availability on April 9, 2026, on both macOS and Windows inside the Claude Desktop app. The pitch is straightforward: most people want the leverage of an agent that can organize files, draft a report from a pile of notes, reconcile a spreadsheet, or build a slide deck, but they do not want to open a terminal to get it.
The reason this matters to a buyer is that Cowork is the same agentic core as Claude Code with a different surface area, a different isolation model, and a different cost profile. Everything that follows in this guide is about those three differences, because they, not the demo, decide whether Cowork belongs on your machines.
Cowork = the Claude Code agent loop + a friendly desktop UI + a hard-isolated Linux VM for code execution. It runs locally on your Mac or PC, only touches folders you mount, and is bundled into every paid Claude plan (not Free).
How is Claude Cowork isolated? The sandbox architecture that decides the purchase
Cowork splits work across two execution environments: the agent loop (conversation, file reads/writes in connected folders, web fetches, MCP plugins) runs natively on your device, while any shell command or code Claude writes executes inside a dedicated, hard-isolated Linux virtual machine managed by the platform hypervisor. On macOS that hypervisor is Apple’s Virtualization.framework (the VZVirtualMachine API); on Windows it is Hyper-V. This is the part the affiliate review farms skip, and it is the part that should drive your decision.
Inside that VM, Anthropic boots a custom Ubuntu 22.04 root filesystem and runs the Claude Code CLI as the execution engine. Reverse-engineering by independent researchers found the VM provisioned with roughly 4 vCPUs, ~3.8 GB RAM, and a sparse ~10 GB disk, with the CLI launched in a stream-JSON loop. The VM is isolated from your host OS by the hypervisor, and Cowork stacks additional Linux sandboxing inside it: bubblewrap to restrict the filesystem view and process capabilities, and seccomp to filter syscalls so out-of-bounds actions are rejected at the kernel level. Network access is forced through an egress proxy with a strict allowlist.
The file model is the other half of the story, and it is explicit by design. Claude cannot wander your disk. It can only read and write folders you deliberately mount into the session, shared into the VM over VirtioFS for fast, bidirectional access. Multiple conversations share one VM but each active session gets its own Linux user (a dedicated UID) with directory permissions that block cross-session access. The net effect: code runs in a box that cannot reach your system files, and the agent cannot touch a folder you did not hand it.
One important caveat that the architecture diagram alone hides: the VM is isolated from your host security tooling by design. That is a feature for safety and a problem for compliance, and we return to it below.
Host: Claude Desktop app (agent loop runs natively) -> launches a per-machine hard-isolated Linux VM via Apple Virtualization.framework (macOS) or Hyper-V (Windows) -> inside the VM, Claude Code CLI runs shell/code under bubblewrap + seccomp, with network forced through an allowlist egress proxy -> the VM can ONLY see folders you explicitly mount (shared over VirtioFS); it cannot reach host system files. Each active session = its own Linux user/UID.
Claude Cowork vs Claude Code vs Computer Use vs Managed Agents
The cleanest way to place Cowork is against its three nearest cousins: Claude Code is the developer-first terminal agent, Cowork is the desktop knowledge-worker agent on the same core, Computer Use is a tier inside Cowork that controls your real screen, and Managed Agents is the cloud API for building deployed agents at scale. The boundary table below is the reference the review farms never publish, because they treat all four as one product.
Two boundaries deserve emphasis. First, Cowork vs Claude Code is mostly about surface and audience, not capability: same models, same plan-and-execute loop, but Code lives in your terminal, VS Code, and CI, while Cowork lives only in the desktop app with a chat UI and an opinionated sandbox. Pick Code when you want configurability and to run in a pipeline; pick Cowork when you want zero setup and a guardrailed box.
Second, Computer Use is the sharp edge. The file-task side of Cowork runs in the isolated VM, but Computer Use (a Pro/Max research-preview tier) drives your actual desktop, clicking and typing in your real apps with no sandbox between Claude and your applications. It exists so the agent can reach apps with no connector or API. That is powerful and genuinely riskier, which is why banking and investment apps are blocked by default and Claude asks permission per app.
“Cowork is Claude Code wearing a friendlier face, wrapped in a hardened local sandbox, and metered on your subscription. The sandbox is its best feature and its biggest misunderstanding.”
Surya Koritala
| Dimension | Cowork (file tasks) | Claude Code | Computer Use (in Cowork) | Managed Agents |
|---|---|---|---|---|
| Primary user | Knowledge workers | Developers | Cowork users needing app reach | Builders / platform teams |
| Where it runs | Desktop app, local VM | Terminal, IDE, CI, desktop | Your real desktop, no sandbox | Anthropic cloud (API) |
| Isolation | Hard-isolated Linux VM | Your shell / chosen sandbox | None between Claude and apps | Cloud-hosted, API-managed |
| Setup | None | Install + configure | Toggle on (preview) | Build against APIs |
| Background / cloud run | No (app must stay open) | No (session-bound) | No (machine awake) | Yes (cloud-hosted) |
| Plans | Pro, Max, Team, Enterprise | Pro, Max, Team, Enterprise | Pro, Max only | Enterprise / API |
Is Claude Cowork included in Claude Pro, and what does Claude Cowork pricing really cost?
Yes, Claude Cowork is included in Claude Pro and in every paid plan above it (Max, Team, Enterprise) with no separate SKU; it is not available on the Free plan. That makes the headline question ‘is Claude Cowork included in Claude Pro’ a clean yes, but the real Claude Cowork pricing question is what your usage costs once it is included, and that answer is plan-dependent and, on Enterprise, genuinely variable.
On the self-serve consumer plans, Cowork draws from your plan’s usage limits rather than a separate meter. Pro is roughly $17/month billed annually or $20 monthly, Max runs $100/month (5x) to $200/month (20x), and the difference between them is usage headroom and priority, not whether you get Cowork. Pro gets full Cowork access with lower limits than Max.
Enterprise is where buyers get surprised. On Enterprise, seats are billed at the seat price and then all model usage, in chat, Claude Code, and Cowork alike, bills separately at standard API rates with no included token allowance. An agentic file task can read large folders, run code, and iterate, so a single heavy Cowork user can burn meaningfully more in API charges than their seat costs. Anthropic gives admins org-level and user-level spend caps precisely because of this, and on sales-assisted plans hitting a cap halts usage until the next period or until an owner raises it. The practical takeaway: treat Cowork as a metered tool on Enterprise and set caps before rollout, not after the first invoice.
On Enterprise there is no flat ‘Cowork is included’ allowance. Every token it consumes bills at API rates on top of the seat. Budget for variance and configure org- and user-level spend caps on day one.
| Plan | Approx. price | Cowork included? | How Cowork usage is metered |
|---|---|---|---|
| Free | $0 | No | N/A |
| Pro | ~$17/mo annual ($20 monthly) | Yes | Plan usage limits (lower headroom) |
| Max 5x / 20x | $100 / $200 per month | Yes | Plan usage limits (high headroom) |
| Team | ~$30/user/mo | Yes | Plan usage limits, per seat |
| Enterprise | Seat price + usage | Yes | Standard API rates, no included tokens, org/user spend caps |
Does Claude Cowork run in the background? The ‘app must stay open’ limit
No, Claude Cowork does not run as a true cloud background agent: the Claude Desktop app must stay open and your machine must stay awake for any task to run, including scheduled ones, because the work executes locally in the VM on your device. If you close the app or your computer sleeps, the session ends and the task stops. This is the single most over-sold aspect of the ‘autonomous coworker’ framing, so answer the question ‘does Claude Cowork run in the background’ carefully when you evaluate it.
Cowork’s GA added Scheduled Tasks, which let you set a job to fire daily or weekly, and that reads like background automation. But desktop Scheduled Tasks are local: they only run while your machine is awake and Claude Desktop is open. Schedule a 7 a.m. report and then close your laptop overnight, and it will not run.
Anthropic does offer true background execution, but it lives in a different product line. Cloud Routines (introduced in research preview shortly after GA) run on Anthropic’s infrastructure on a schedule even when your laptop is closed, and Managed Agents are cloud-hosted agents you build against APIs. If your requirement is ‘this must run whether or not my computer is on,’ that is Routines or Managed Agents, not desktop Cowork. Conflating the two is the most expensive mistake in a Cowork evaluation.
Pros
Cons
When should you NOT use Claude Cowork? Enterprise, audit, and the NHI problem
Do not use Claude Cowork for regulated or audit-bound workloads: Anthropic itself advises against it because Cowork activity is excluded from Anthropic’s Audit Logs, Compliance API, and Data Exports, so a SOC 2 Type II, HIPAA, or PCI-DSS program cannot produce a complete record of what Cowork accessed or generated. For Claude Cowork enterprise rollouts, this is the governance line that matters more than any feature, and it is exactly what the recycled feature-list reviews omit.
The mechanism is a direct consequence of the architecture above: the VM is intentionally isolated from host-based security tooling, and the desktop agent loop is not wired into the same audit plane as Anthropic’s enterprise logging. OpenTelemetry support shipped at GA gives you operational telemetry, but it is not a compliance audit log and does not substitute for one. Cowork is also excluded from Anthropic’s BAA, so PHI workloads are off-limits until Anthropic closes the gap.
There is a second, quieter issue IT teams should name: non-human identity (NHI). When Cowork acts through your connectors, it is operating with your credentials and your access, but its actions are not individually attributable in a compliance-grade trail. Until that audit coverage exists, treat Cowork as a productivity tool for non-sensitive data, scope mounted folders tightly, lean on per-tool connector controls and spend caps, and document a clear ‘Cowork prohibited for SOX/HIPAA/PCI/SOC 2 in-scope data’ policy. Use Claude Code, Managed Agents, or the Enterprise chat surface, which are covered by the audit plane, where you need provability.
PHI under HIPAA, cardholder data under PCI-DSS, SOX-relevant financial workflows, or anything in your SOC 2 Type II scope. Cowork is excluded from Audit Logs, the Compliance API, Data Exports, and the BAA. OpenTelemetry telemetry is not an audit log.
What are the system requirements for Claude Cowork?
Claude Cowork requires a Mac with Apple Silicon (M1 or later) running a recent macOS, or a 64-bit Windows 10/11 PC on an edition that includes Hyper-V (Pro, Enterprise, or Education), with at least 8 GB RAM and roughly 10 GB free disk. Because the sandbox is a real virtual machine, the hardware floor is higher than a chat client, and two constraints catch people out.
First, on the Mac, Cowork needs Apple Silicon. Intel Macs are not supported because the VZVirtualMachine boot path Anthropic uses targets the Apple Silicon virtualization stack. Second, on Windows the edition matters: the VM depends on the Hyper-V stack, which ships with Windows Pro, Enterprise, and Education but not with Windows Home, and Windows on Arm is not yet supported, so you need x64 hardware. The desktop app also includes readiness checks for macOS, Windows x64, and Windows Arm64 to tell you whether your machine qualifies before you start.
Plan-wise, the gate is simple: you need a paid plan (Pro, Max, Team, or Enterprise). There is no Free-tier path to Cowork, and Computer Use, the real-desktop tier, is currently limited to Pro and Max in research preview, not Team or Enterprise.
Quick requirements checklist
macOS: Apple Silicon (M1/M2/M3/M4), recent macOS, 8 GB+ RAM. Windows: 64-bit x64 CPU, Windows 10/11 Pro/Enterprise/Education with Hyper-V (not Home), 8 GB+ RAM (16 GB recommended), ~10 GB free disk. Plan: any paid plan (Pro and up). Computer Use: Pro/Max only, research preview. Background: none; app open + machine awake required.Builder’s take
I run agent infrastructure for a living, so I read Cowork the way an IT buyer should: not by its feature list, but by its isolation model and its billing meter. Three things stand out.
- The sandbox story is genuinely strong for code execution, but it is not a compliance boundary. Cowork activity is excluded from Anthropic’s Audit Logs, Compliance API, and Data Exports, so a regulated org cannot prove what it touched. That single gap should drive your deploy decision more than any feature.
- The pricing looks like ‘included’ but it is not flat. On Enterprise, every token Cowork burns bills at standard API rates on top of the seat price, so a heavy user can quietly cost more than their seat. Set org- and user-level spend caps before you roll it out, not after.
- The ‘autonomous background coworker’ framing oversells reality. Desktop Scheduled Tasks only fire while the app is open and the machine is awake. If you need work to survive a closed laptop, that is cloud Routines or Managed Agents, not Cowork.
Frequently asked questions
Claude Cowork is Anthropic’s desktop AI agent that runs the Claude Code agentic engine for non-technical knowledge work, executing multi-step tasks against folders you mount, with code running inside a hard-isolated local Linux VM. It went GA on April 9, 2026, on macOS and Windows.
Yes. Cowork is included on every paid plan, Pro, Max, Team, and Enterprise, with no separate SKU. It is not available on the Free plan. Pro gives full Cowork access with lower usage limits than Max, and the minimum entry point is Pro at roughly $17/month billed annually.
On consumer plans (Pro/Max) Cowork draws from your plan’s usage limits, so there is no extra charge. On Enterprise there is no included token allowance: all Cowork, chat, and Claude Code usage bills at standard API rates on top of the per-seat price, which is why Anthropic provides org-level and user-level spend caps.
No. Cowork runs locally, and the Claude Desktop app must stay open with the machine awake, even for scheduled tasks. Desktop Scheduled Tasks only fire while the app is open. For true background runs that survive a closed laptop, use Cloud Routines (research preview) or Managed Agents, which run on Anthropic’s infrastructure.
Code executes in a hard-isolated Linux VM via Apple Virtualization.framework on macOS or Hyper-V on Windows, with bubblewrap, seccomp, and an egress allowlist. It can only touch folders you mount and cannot reach system files. However, Cowork activity is excluded from Audit Logs and the Compliance API, so it is not appropriate for regulated data that needs a compliance-grade audit trail.
They share the same models and agentic loop. Claude Code is the developer-first terminal/IDE/CI agent you install and configure; Cowork is the zero-setup desktop agent for knowledge workers, wrapped in an opinionated local VM sandbox. Choose Code for configurability and pipelines, Cowork for ease of use and guardrails on a non-technical user’s machine.
Primary sources
- Get started with Claude Cowork — Anthropic Help Center
- Claude Cowork desktop architecture overview — Anthropic Help Center
- Let Claude use your computer in Cowork — Anthropic Help Center
- How am I billed for my Enterprise plan? — Anthropic Help Center
- Inside Claude Cowork: How Anthropic Runs Claude Code in a Local VM — Pvieito
- Anthropic Launches Managed Agents and Claude Cowork GA: April 9, 2026 — Pasquale Pillitteri
- Claude Cowork Audit Logging Gap — MintMCP
- Plans & Pricing — Anthropic
Last updated: June 3, 2026. Related: Products.
