Securing Claude Cowork: An Enterprise Runtime Primer

The first mistake is to treat Claude Cowork as a normal assistant conversation. Cowork can take a goal, keep working, use local files, operate through plugins, reach connectors, use MCP-style tools, run code in controlled environments, and in some modes interact with browser or desktop surfaces. The user prompt is only the beginning of the execution graph.

That execution graph has to be governed at the action boundary. A policy that only reviews prompts cannot distinguish between a harmless summary and a plugin call that exports a customer list. A network control that only sees domains cannot explain which agent session, workspace, policy, and tool argument produced the request.

AgentKeeper uses the same operating model it applies to Claude Code: collect the host and session envelope, normalize the proposed action, evaluate policy, and retain enough evidence for review. The Cowork-specific work is mapping a desktop/plugin runtime into that policy model without pretending every Cowork capability exposes the same fidelity.

For supported Cowork hook paths, AgentKeeper can record source_tool=cowork, workstation, workspace, hook event, tool name, tool input summary, semantic action, policy verdict, and redacted context. That means file restrictions and MCP/tool policies can apply to Cowork without creating a separate policy universe for every agent surface.

Cowork deployment should not be considered complete because a script printed installed. A serious rollout needs a self-test, a last hook invocation timestamp, a last evaluate request timestamp, the tool name that was evaluated, an HTTP status, and a workstation record that moves from offline to active when Cowork actually invokes the hook.

Those details matter because desktop agents fail in ordinary ways: cached plugin manifests, stale app sessions, changed workspace paths, old shell versions, missing API keys, corporate proxy interference, and users who forget to fully restart the desktop application. The status page should make those failures diagnosable without asking an enterprise pilot user to reverse engineer their app bundle.

No Cowork security product should claim to see every pixel-level decision or every SaaS-side connector action from the local desktop. Some paths need managed browser policy, SaaS audit logs, identity controls, endpoint telemetry, or a gateway owned by the organization. The value of AgentKeeper is that it captures the high-fidelity agent events that do pass through supported hooks and turns them into enforceable, explainable policy.

That is the enablement argument. Security can start with visibility, prove which workstations and actions are covered, tune policies from real passed events, then block the small set of operations that create unacceptable blast radius.