Claude Cowork for business: what changed in October 2026, security and rollout

Claude Cowork is the way Claude takes on a long task: you open folders and tools to it, it works through the steps and hands you a deliverable. Since October 2026, this way of working is no longer a separate tab, and by default it runs in the cloud, meaning on remote servers, here Anthropic’s.

For a business, the question now is how to frame what it delegates: which folders, which connectors, which actions without human sign-off. This guide, current as of October 12, 2026, gathers facts checked at the source and a rollout method.

The essentials in six points

• Cowork hands Claude a whole task rather than a question: it reads your documents, works through the steps and returns a file for you to review. To try it, follow the first-task walkthrough.
• For you, the main change needs no setup: no more mode to pick, and the task keeps going with your laptop closed, because it runs on Anthropic’s servers.
• Cowork is included in every paid plan, from $20 a month for individuals and $20 per seat per month for teams, billed annually.
• A firm on the Team plan (the team subscription) needs to decide explicitly where tasks run: on Anthropic’s servers by default, or on the device; confidentiality questions should be settled first.
• The Enterprise plan gives IT permissions by employee group and spend limits, and both Team and Enterprise can send the log of Claude’s actions to the security monitoring tool.
• Built-in protections do not replace scoping: files once got out through an address that was supposed to be safe; Anthropic has fixed it.

Claude Cowork in one sentence, and why the name is fading

Cowork hands Claude a task rather than a question. It reads your files, queries your tools through connectors (links to Gmail, Google Drive, Microsoft 365 or a CRM), then produces a finished document.

On September 16, 2026, Anthropic announced that Cowork and chat are becoming one Claude: “Starting today, Claude Cowork and chat are merging into one Claude.”

The help center sums it up: “Claude Cowork is now just Claude.”

The name is fading because the capability is becoming the default. The choice that remains is the scope you open to Claude.

Starting Cowork and handing it a first task

Cowork opens from claude.ai in the browser, from the Claude Desktop app or from the mobile app.

According to the help center, an account that has received the new experience no longer shows a “Cowork” button: you describe what you need and Claude decides whether to answer or start a task. On an account that has not received it yet, select “Cowork” in the message box.

Example: preparing a summary note from a case file.

1. Open the folder to Claude. To work on files on your computer, you need the desktop app: from the message box, add the folder holding the documents. Claude reaches only connected folders, and only while the app is open. For online documents reachable through a connector, such as Google Drive or Microsoft 365, the browser or the mobile app is enough.
2. Describe the task. “Read the documents in the folder and write a two-page summary note: facts, points in dispute, upcoming deadlines. Flag any contradictory information.”
3. Review the proposed approach. Claude sets out its plan before acting; you approve or adjust it, then let it work.
4. Answer permission requests. In “Manually approve” mode, Claude pauses before each action. Permanently deleting a file always requires clicking “Allow”.
5. Review the deliverable. Claude returns a document you review before any use. A session cannot be shared, but the document it produces can.

The help center warns that a multi-step task uses more of your usage allowance than a quick question.

Is it for me, and how much does Claude Cowork cost

If you regularly produce documents from scattered material, notes, summaries, spreadsheets or presentations, Cowork is for you. It is included in every paid plan.

According to the pricing page, checked on October 12, 2026:

• Pro: $20 per month, or $17 per month billed annually;
• Max: $100 or $200 per month, depending on usage volume;
• Team: $20 per seat per month billed annually, $25 monthly, for 2 to 150 people;
• Enterprise: $20 per seat per month billed annually, plus usage.

Pro suits regular use, which Anthropic describes as “everyday work”. Max offers five or twenty times more usage than Pro and targets “people who work with Claude all day”: it makes sense if Pro’s limits interrupt your long tasks.

On Pro and Max, the files Claude reads pass through Anthropic’s servers. Whether they are used to train the models depends on a privacy setting, under Settings > Privacy, worth checking before you hand over sensitive documents. Business plans follow different rules, covered in the section on professional secrecy. The full comparison is in our guide to Claude for business.

Chat, Cowork or Claude Code: which tool for which task

Anthropic’s rollout guide of April 29, 2026 sorts tasks by their shape. The September merge brings the first two rows together, but the distinction still helps when training a team.

Shape of the task	Surface	What sets it apart
A question, a rewrite, a first draft	Chat	Immediate answer, no setup
A deliverable built from your files and tools	Cowork	Folder access, connectors, skills, scheduled tasks
Writing, testing and shipping software	Claude Code	Access to the code, the tests and the Git history

The practical test fits in one line: when the expected output is a document to review rather than an answer, the task belongs in Cowork.

What Cowork does: folders, connectors, plugins, scheduled tasks

Cowork is made of four capabilities. Each one widens what Claude can reach, and therefore what you need to scope.

• Folders: you choose the folders Claude reads and edits. Global or folder-level instructions give it standing context, your formats and your rules.
• Connectors: they link Claude to your tools, from email to CRM, read-only or read-write depending on the rights granted.
• Plugins: a plugin bundles skills, method sheets Claude applies on its own, with commands and connectors, for one line of work. The Claude Skills guide covers how to build and secure them.
• Scheduled tasks: type /schedule in a task’s message box to make it recur at regular intervals; the “Scheduled” item in the sidebar lists them. According to the help center, these tasks run in the cloud and do not need your computer to be awake.

2026 timeline, January to October

Dates come from Anthropic’s release notes and the announcements cited.

• January 12: research preview on Claude Desktop, macOS only, for the Max plan; opened to Pro on January 16.
• January 30: plugins arrive, with eleven plugins released as open source (sales, legal, finance, data, among others).
• February 24: ten more role-specific plugins, from investment banking to HR, new connectors (Google Drive, Gmail, DocuSign, FactSet) and private plugin marketplaces for organizations.
• February 25: scheduled tasks, recurring or on demand.
• April 9: general availability on every paid plan, macOS and Windows, with new admin controls.
• July 7: Cowork comes to web and mobile, with sessions running remotely, in beta.
• September 16: merge with chat, starting with Pro and Max.
• October 6: new Pro and Max tasks run in the cloud, with no local option.

If you use Claude on your own, on a Pro or Max plan, you can stop here. What follows is for firms, IT departments and rollout leads.

Business plans and beta status

Status varies by plan and surface, according to the help center article on Team and Enterprise.

	Pro and Max	Team	Enterprise
Desktop app (macOS, Windows)	Available	Available	Available
Cloud execution	Default since October 6	Beta, on by default	Beta, off by default, granted by role
Local sessions	No longer offered for new tasks	Available	Available
Merge with chat	Rolling out since September 16	To follow	At least 30 days’ notice to admins

An organization with a HIPAA configuration, the US health data protection framework, has Cowork off by default, and cloud execution is not available there.

Where the work runs and where your files go

On Pro and Max, since October 6, 2026, the task runs in an isolated environment on Anthropic’s servers, separate from your computer and your network. Felix Rieseberg of Anthropic summed it up on October 5, quoted by Simon Willison: inference, the computation through which the model produces its answers, and the virtual machine move to the cloud, and each session gets its own environment, sharing no state with the others.

Your local files are not uploaded wholesale.

The help center states that Claude fetches a copy of only the file it needs, from connected folders, “only while the desktop app is open”. With the app closed, the task carries on but loses access to those folders. The copies fetched are deleted when you delete the session.

On Team and Enterprise, a local session remains possible. It runs in a virtual machine, a simulated and sealed-off computer inside the user’s device. Its history then stays on that device, and the help center warns that administrators cannot manage or delete it centrally.

Claude Cowork on Windows: the virtualization requirement

For a local session on Windows, Anthropic’s documentation requires the .msix installer, hardware virtualization turned on and the Windows “Virtual Machine Platform” feature. A fleet installed with the legacy .exe gets Claude Desktop without Cowork.

Note dated October 12, 2026: the two help articles on cloud tasks no longer mention this requirement. It should therefore no longer block a new Pro or Max task. For a local session on Team or Enterprise, check it before training with the readiness tool Anthropic provides.

For a fleet rollout, the installation documentation states that the .msix package supports per-machine provisioning, distributed through your usual software deployment tools.

Professional secrecy, GDPR and data location

These points do not call for a general opinion: each firm settles them against its own rules. Here is what Anthropic’s sources say as of October 12, 2026.

What the terms say

• Model training. For business plans, Team, Enterprise and API, Anthropic writes: “By default, we will not use your inputs or outputs from our commercial products to train our models.” On Free, Pro and Max, training depends on a privacy setting each user should check.
• Data processing agreement. Anthropic’s Data Processing Addendum is part of the commercial terms; Anthropic’s article on legal work presents these commercial terms as the baseline expected for legal use.
• Retention. On Enterprise, the owner can set a retention period of at least 30 days; without it, data is kept indefinitely. This setting does not apply to local sessions.
• Execution region. The Cowork help articles reviewed say sessions run “in Anthropic’s cloud” without naming a region. No public Anthropic information on where cloud Cowork sessions are located was found as of this date.

The point to watch for a firm on Team

On Team, cloud execution is on by default. Decide it explicitly, in Organization settings > Cowork, rather than inheriting it. In a local session, the documents stay on the device, but the history escapes central management; in the cloud, copies of the documents read pass through Anthropic’s servers and sessions are tied to the user’s account.

The questions to settle before opening a client file: which categories of documents are allowed, which plan and contract cover the processing, cloud or local session, which retention period, and who reviews each deliverable.

Inference in your own cloud environment

To keep control over location, Cowork can run with inference from Amazon Bedrock, Google Cloud or Microsoft Foundry, in the cloud environment your organization controls. According to the documentation for this mode, prompts go only to your provider and conversations stay on the device.

This mode has trade-offs. The work then runs in the device’s virtual machine, with the Windows requirements described above, and configuration is deployed through the admin console, a device management profile or an internal server. It suits organizations that already have a contract with one of these providers.

For law firms and other regulated professions, the AI for regulated professions course covers these trade-offs.

Claude Cowork security: isolation, prompt injection, admin controls

Cowork reads documents, pages and messages you did not write. The main risk is prompt injection: an instruction hidden in content, which the agent reads and may follow as if it came from you.

Built-in protections

• Isolation: each session runs in its own environment, with no access to the rest of your computer or your network.
• Approval: there are three modes. Manual approval pauses Claude before each action; automatic approval has each action reviewed, notably for data exfiltration and prompt injection, before it runs; a third mode, “Skip all approvals”, removes any review, and the help center reserves it for connectors and actions you fully trust.
• Deletion: permanently deleting a file requires your explicit approval.

What Anthropic’s own experience shows

In an engineering article of May 25, 2026, Anthropic describes the architecture of the local version: only the chosen folder and the .claude folder are mounted in the virtual machine, and credentials stay in the device’s keychain. That description applies to local sessions, not as-is to the cloud.

The same article reports a case disclosed by a third party. A booby-trapped file carried an attacker’s key; Claude sent other files to Anthropic’s Files API, an allowed domain, and the filter let it through.

Allowing a domain therefore gives the agent a way to send data there. The flaw is fixed: only the session’s own token is now accepted.

Two more findings shed light on the human’s role. In Claude Code, the developers’ tool, users approved roughly 93% of permission prompts: the more approvals, the less attention.

The virtual machine’s isolation also made local Cowork sessions opaque to EDRs, the tools that detect suspicious behavior on devices. Anthropic’s workaround is an export of event logs retrieved after the fact, which the article admits is not the same as live monitoring.

What the administrator controls

Yes, the administrator can turn Cowork off for the whole organization, on Team as on Enterprise, in Organization settings > Cowork. The same screen decides on cloud execution. Web search is turned off elsewhere, in Organization settings > Capabilities.

On Team and Enterprise, Cowork events can be streamed to your SIEM, the tool that centralizes security logs, through OpenTelemetry, a standard trace export format.

According to the April 9, 2026 post, these events cover tool and connector calls, files read or modified, skills used, and whether each action was approved manually or automatically, in a format compatible with Splunk.

Enterprise adds:

• roles by group, set manually or synced through SCIM, the protocol that carries over the groups in your corporate directory;
• spend limits per group and usage analytics.

Since April 9, administrators can also restrict the actions in each connector, for example allowing read but not write. Finally, the Compliance API, the export interface for compliance teams, returns Cowork sessions from the last 30 days only.

Rolling out Claude Cowork in a company: pilot, first use case, measurement

Anthropic’s guide of April 29, 2026 sets out a five-level maturity ladder: asking questions, building a deliverable, turning it into a skill, bundling and scheduling skills, then shipping one plugin per department. Each user climbs one level at a time.

The pilot

• Security review first: data boundaries, connector permissions, logging.
• Two or three willing teams, not one: several teams let you separate what comes from the method and what comes from the team.
• Criteria set before the start. The guide is blunt: hours saved per week can be measured, “transformation” cannot.

To choose the pilot teams and the first task, an AI maturity audit establishes what can be tested right away and what should wait.

The first use case

Pick a frequent, repetitive and verifiable task whose output is quick to review: a weekly summary, a meeting prep pack, a monitoring note. Prepare it before launch so that the first session produces something useful.

Measurement

OpenTelemetry events give the baseline: sessions, actions approved manually or automatically, connectors used. Add the business measure, the time from request to reviewed deliverable, and the share of deliverables accepted without heavy rework. This follow-up at one and three months is at the heart of an AI enablement programme.

Anonymized training feedback: what gets stuck, what takes hold

Two situations from the AI agents training for companies and the Claude courses run by Colombani.ai, anonymized.

In a three-partner firm, the workspace with its instructions file was adopted by everyone. The session ran longer than planned: the notion of context, what Claude keeps in view during a task, takes time to grasp.

The partners’ questions focused on two points: finding past conversations, and reusing a context from one matter to the next.

Anthropic’s documentation offers two answers: global instructions, which apply to every task, and folder instructions, which travel with that folder. According to Anthropic, the September merge keeps existing conversations, projects, connectors and skills.

For a lawyer practicing alone on Windows, Cowork would not start: virtualization was not turned on on her machine. Forty minutes of the session were lost.

Since the move to the cloud on October 6, this requirement no longer appears in the documentation for Pro and Max tasks; it still needs checking before any local session. The lesson holds for any training: check the devices before the session, and prepare the context before handing over the first task.

Going further

Rolling out Cowork means deciding what the organization delegates, to whom, and under what control.

• For business teams, the Claude training course teaches how to prepare context, hand over a task and check the deliverable; Cowork is also part of the AI agents training for companies.
• For IT, the AI agent security course covers prompt injection, connectors and logging.
• For an IT department preparing the rollout, Colombani.ai supports scoping, the security review and a measured pilot, through AI adoption strategy and AI security.
• A Cowork rollout kit brings together the pilot grid, the admin settings and first use cases.

Colombani.ai is Qualiopi-certified for training activities. Its founder, Ulysse Trin, holds the Claude Certified Architect Professional, issued by Anthropic.