CrowdStrike Brings Falcon Guardian Into Claude Cowork VMs
Summary
CrowdStrike says Falcon Guardian will monitor process, package and network activity inside Claude Cowork’s VM. The integration is in beta on macOS; Windows support is expected later in November 2026.
Key points
- Cowork’s VM can run code and access mounted host folders, while host-only endpoint sensors may not see the processes, packages or network connections inside it.
- CrowdStrike announced that its Falcon Linux sensor will run inside the Cowork VM to provide runtime visibility and detection.
- The sensor is intended to help detect threats such as a compromised package accessing host data through a mounted folder and sending it to a malicious endpoint.
- The integration is available in beta on macOS; Windows support is expected later in November 2026.
- Administrators can deploy the integration through existing device-management tools and control it through the Falcon platform.
- CrowdStrike says the integration focuses on visibility and detection inside the VM.
Article Details
- Event Type
- CrowdStrike announced a beta integration bringing Falcon Guardian protection into Anthropic's Claude Cowork virtual machine.
- Impact
- The Falcon sensor runs inside the Cowork VM to provide visibility and detection for processes, packages, and network activity that host-based monitoring may not see. The integration is available in beta on macOS; Windows support was expected later in November 2026. The article describes a hypothetical compromised-package scenario, not a confirmed incident, and says the integration focuses on visibility and detection inside the VM.
Vendors
AnthropicToday at Fal.Con Europe 2026, CrowdStrike announced it is bringing CrowdStrike Falcon® Guardian protection natively into Anthropic's Claude Cowork.CrowdStrikeToday at Fal.Con Europe 2026, CrowdStrike announced it is bringing CrowdStrike Falcon® Guardian protection natively into Anthropic's Claude Cowork.