CrowdStrike Secures AI Agents Inside Claude Cowork
CrowdStrike, Tuesday, November 3rd, 2026
CrowdStrike is bringing Falcon Guardian protection into Anthropic's Claude Cowork, running the Falcon sensor inside the Cowork VM.
At Fal.Con Europe 2026, CrowdStrike announced it is bringing Falcon Guardian protection natively into Anthropic's Claude Cowork, built in partnership with Anthropic.
Cowork runs code in an isolated virtual machine whose internal processes, package installs and network connections are not visible to the host's endpoint sensor, even though host folders can be mounted into it.
The integration runs the Falcon sensor inside the Cowork VM to provide runtime visibility and detection, and is in beta on macOS, with Windows support expected later in November.
CrowdStrike gives the example of detecting a compromised Python package that reads mounted host data and sends it to a malicious endpoint.