Palo Alto Networks adds Cortex XDR sensor to Claude Cowork

Palo Alto Networks announced a Cortex XDR integration with Claude Cowork, the desktop agent in Claude Enterprise from Anthropic. A small sensor operates in the virtual machine where the agent works. It shows which systems the agent used, which files it changed and which commands it ran. The company says the private preview starts in the next months.

How it works

Claude Cowork plans and completes tasks with many steps. It reads files, uses applications and does workflows in a small local virtual machine. The box is a safety boundary. It also stops the endpoint detection tool from the view of the work.

The new sensor sends data from the box to Cortex XDR. The system joins related events into one incident story and shows them with the other data of the computer.

The proof

The company gave no test results and no numbers. It says the system uses threat intelligence and machine learning models to stop new threats by default. The tool is not on sale at this time.

What is not known

The company gave no date and no price. It says that a tool not on sale can come after the date or not at all. No customer has shown that the sensor finds attacks on the agent.

Insight: Agent safety boxes make a gap for endpoint tools

Claude Cowork works in a sealed virtual machine, and that seal stops endpoint tools from the view of the agent. Vercel Labs released an open source tool that gives agents computer use on 3 operating systems,. This reads as a gate: each new area for agents makes a space without a sensor. Tool vendors possibly want the first sensor there. Tell each vendor to show how your team can see the agent.