CrowdStrike and Anthropic: Claude Cowork Security Integration
CrowdStrike has introduced a native security integration with Anthropic’s Claude Cowork that deploys the Falcon Linux sensor inside agent virtual machines to mitigate supply chain and execution risks within isolated AI environments.
Triage facts
Revision 1- Applicability
- Claude Cowork
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 09:35 UTC
- Source quality
- A2Roughly even chance
CrowdStrike has partnered with Anthropic to provide runtime visibility and security for the Claude Cowork AI agent platform. Previously, code execution within Claude Cowork occurred inside an isolated virtual machine that served as a blind spot for host-based endpoint security sensors. By deploying a Falcon Linux sensor directly inside the Cowork VM, defenders can now monitor process, package, and network activity originating from the agent. This integration is currently in beta for macOS, with Windows support expected in late November 2026.
Impact
The integration addresses the risk of AI agents inadvertently executing malicious code, such as compromised software packages, which could otherwise leverage mounted host folders to exfiltrate data without host-level visibility.
Recommendation
- Inventory all workstations utilizing the Claude Cowork agent within the environment.
- Prepare for the beta deployment of the Falcon Linux sensor inside Claude Cowork virtual machines, beginning with macOS endpoints.
- Configure existing Falcon device management tools to support the forthcoming sensor deployment for the Windows platform, expected in late November 2026.
Threat Hunt
Identify workstation activity associated with the Claude Cowork virtual machine process
Data: Host-level process creation logs, Hypervisor or virtualization logs
Mitigations
Enroll in the beta program for CrowdStrike Falcon integration within Claude Cowork for macOS users.
Claude Cowork