Anthropic's new Cowork feature brings Claude Code's agent capabilities to people who don't write code

Anthropic is expanding its AI assistant Claude with a new feature called Cowork, bringing Claude Code's agent-based workflow to people who don't write code.

The concept is simple: while Claude Code works with programming files on GitHub, for example, Cowork gives Claude access to a local folder on your computer. From there, the AI can read, edit, and create files on its own, shifting Claude from answering questions to completing tasks.

The idea came from watching how developers actually used Claude Code. After launch, Anthropic noticed developers weren't just writing code with it, they were tackling all kinds of tasks. Cowork takes that same capability and packages it for people without coding skills. It runs on the same foundation, particularly the Claude Agent SDK. Claude Code has become something of a standard among developers, though the space is moving fast.

Why this matters for AI assistants

Both products share the same goal: taking AI models' growing agentic capabilities, like making autonomous decisions, running commands, and searching the web, and putting them in an environment where users can put these abilities to work.

According to Anthropic, practical use cases range from organizing your downloads folder and turning screenshots into spreadsheets to drafting reports from scattered notes. Users can queue up multiple tasks for Claude to handle in parallel. The interaction feels less like a conversation and more like leaving notes for a colleague, the company says.

Cowork also hooks into existing connectors for external data sources. Anthropic has added new skills for creating documents and presentations, and with Claude in Chrome, the AI can tackle tasks that need browser access.

More autonomy brings security tradeoffs

Users control which folders and connectors Claude can access, and the AI asks permission before taking significant actions. Still, Anthropic warns that Claude could perform destructive actions, like deleting files, if instructed to do so or if it misunderstands the request.

Another concern is prompt injection, where bad actors try to manipulate Claude's behavior through malicious prompts hidden on websites or in documents. It's a fundamental flaw in large language models known since GPT-3 that remains unsolved, and the risk grows as these systems generate more text and use more tools.

Anthropic has built defenses against this, but "agent safety" remains, to put it politely, a work in progress across the industry. Recent data from Anthropic shows that even its best model, Opus 4.5, falls for prompt injections more than 3 out of 10 times when attackers get ten attempts. The problem might be manageable for now, but it requires careful control over what the AI can access. That's a call IT administrators will have to make, not individual users who have never heard of prompt injection in the first place.

Limited availability at launch

Cowork is currently available as a "Research Preview." Since it uses more tokens than normal chat, it has its own tab. For now, Cowork is only available to Claude Max subscribers through the macOS app. Everyone else can sign up for the waiting list. Cowork launches as a "research preview," with Anthropic planning to refine the feature based on real-world usage. Future updates will add cross-device sync and a Windows version.