What Is Claude Cowork? Pricing, Use Cases, and Safety

Claude Cowork is Anthropic’s paid knowledge-work agent. It can read connected files, browse the web, produce documents, and coordinate work across apps. Unlike ordinary Claude chat, it can carry out multi-step tasks. That makes its permission settings important before you connect real files or accounts.

Claude Cowork is Anthropic’s answer to a gap that every business owner hits with conversational AI: you get the answer, but the work of turning it into a finished document, a researched report, or an organized folder is still yours to do manually.

Cowork can read files, browse sites, write outputs, and work with connected tools such as Slack and Google Drive. You describe the result instead of narrating every step. That extra autonomy is useful, but it also makes access and approval settings part of the setup.

This guide covers what Cowork is (and how it differs from Claude chat and Claude Code), current pricing, realistic use cases, how the three permission modes work, what remote session isolation actually protects, the July 2026 SharedRoot security report and its current status, and a practical checklist to run before you connect any real files or accounts.

What Is Claude Cowork - and How Is It Different from Claude Chat and Claude Code?

Anthropic describes Claude Cowork as bringing Claude Code’s approach to knowledge work beyond coding, without requiring a terminal. That’s the shortest accurate summary. Here’s the fuller picture:

Anthropic’s own product matrix puts it plainly: chat for conversational drafting, Claude Code for coding, Cowork for cross-app knowledge work. If you’re a solo business owner or consultant who wants AI help with research, document prep, or recurring reports - and you don’t want to write code to get there - Cowork is the product in this lineup designed for that.

Claude Cowork Pricing: Is It Free?

Claude Cowork is not available on the free plan. It requires a paid subscription.

Team and Enterprise plans also include Cowork. Those plans are priced per seat and designed for organizations. Current pricing above is from Anthropic’s official plan page as of July 2026.

Long Cowork tasks use more of your plan allowance than a short chat. Check Anthropic’s current usage limits against the work you plan to run before choosing Pro or Max.

What Claude Cowork Can Do: Realistic Use Cases

The Anthropic product guide published June 5, 2026 describes seven common workflows. Here are the use cases most relevant to solo business owners, consultants, and small teams - described by what actually happens, not what the marketing says:

• Research briefs. Describe a topic and a desired format. Cowork browses the web, pulls from connected documents, and writes a synthesized brief with citations back to the actual sources it read.
• Meeting prep. Cowork can read your notes, recent emails from a connected inbox, and relevant files to produce a structured pre-meeting summary - without you assembling it manually.
• Recurring reports. Scheduled tasks let you define a report cadence. Cowork runs the task on that schedule remotely, with no device required to be online.
• Document and spreadsheet production. Cowork creates polished Excel files with working formulas and PowerPoint presentations as deliverables you can download and edit further.
• File organization. Claude can read from and write to local folders you’ve connected, reorganizing or renaming files according to rules you describe.
• Cross-app coordination. With connected tools like Slack and Google Drive, Cowork can pull from one source and write to another as part of a single task.
• Web task automation. Paired with Claude in Chrome, Cowork can navigate websites, click, type, and fill forms for tasks that require browser interaction.

One thing worth naming: Cowork is still a drafting and execution tool, not a judgment tool. It produces finished outputs, but you still decide what to do with them. The more consequential the downstream action - sending something externally, making a purchase, modifying critical files - the more you want to stay in the task, not step away from it.

If you’re thinking through what a capable AI helper looks like for ongoing business work, this sits within the broader category of agentic AI - software that plans, coordinates, and acts rather than just responding. The distinction between tools that draft for your review and tools that act autonomously is the one that matters most before granting access.

How to Use Claude Cowork: The Three Permission Modes

Cowork gives you three modes that control when Claude stops to ask your permission before taking an action. You can change the mode at any time from the selector in the chat box.

One protection applies across all three modes: file deletion always requires your explicit permission. You’ll see a separate prompt you must actively allow before Claude can permanently delete anything.

What Remote Session Isolation Actually Protects - and What It Doesn’t

Cowork sessions run remotely on Anthropic’s servers in an isolated, temporary environment created for each session and removed when it ends. That environment cannot reach your home network or company network. Your local computer and files stay off limits unless you explicitly connect them through the Claude Desktop app.

Here is the part that trips people up, stated directly from Anthropic’s own safety documentation: isolation limits where Claude’s code runs. It does not limit what Claude can read or do through the access you’ve granted.

If you connect email, Claude can read it. If you connect Google Drive, Claude can work with the files allowed by that connection. A folder shared through the Desktop app is also within reach. Remote execution changes where code runs. It does not cancel the access you granted.

This is why Anthropic’s guidance focuses on what Claude can read and what Claude is allowed to do - not on where the session runs. The isolation is real and meaningful for code execution and network access. It is not a substitute for thinking carefully about which apps and folders you connect.

A related risk is prompt injection: malicious instructions embedded in content Claude reads as part of a legitimate task. The risk requires two things to be true at once - Claude can read content outside your trusted sources, and Claude has permission to take consequential actions. Removing either condition makes a successful attack significantly harder. Narrow access and Manual mode are the practical controls.

The SharedRoot Sandbox Report (July 2026): What Happened and Where It Stands

In July 2026, security researchers at Accomplish published a report called SharedRoot, documenting a sandbox-escape vulnerability in the local execution path of Claude Cowork on macOS.

The short version: when Cowork ran tasks locally inside a Linux virtual machine on the user’s Mac, untrusted content in the session could escape the VM and read and write files across the entire host filesystem - including SSH keys and cloud credentials - with no permission prompt. The researchers connected a folder to a fresh Cowork session and demonstrated the escape end-to-end on their own machine.

The escape relied on a Linux kernel bug (CVE-2026-46331, a public vulnerability in the kernel’s act_pedit networking module disclosed in June 2026) combined with four design decisions in how Cowork’s local VM was configured: unprivileged user namespaces were enabled, the seccomp filter used a default-allow posture that permitted the necessary syscalls, unused kernel modules were autoloaded rather than blocked, and the entire host filesystem was mounted read-write into the VM rather than being scoped to only connected folders.

The researchers reported the vulnerability to Anthropic. Anthropic closed the report as “Informative.” Cowork now uses cloud execution by default - the remote session model described throughout this guide - and the researchers state this local escape path does not appear to apply to cloud execution.

The researchers’ analysis is worth reading on its own terms. Their point isn’t that this specific CVE is catastrophic - it’s that four design choices above the kernel layer would each have blocked the escape independently, and those choices generalize to future kernel bugs in the same category. With AI-assisted vulnerability research accelerating, the researchers argue the gap between a kernel fix landing and a working exploit being available has collapsed to hours. The mitigation that matters most is not mounting the entire host filesystem into a VM that processes untrusted content.

For users today: Cowork’s default is now cloud execution. The local VM path that enabled SharedRoot is not the current default. If you’re running Cowork in a configuration that still uses local execution, that’s worth reviewing.

Before You Grant File Access: A Practical Checklist

The guidance below is drawn from Anthropic’s own safety documentation. Before connecting files, accounts, or browser access to a Cowork session, work through these questions:

Identifying the right AI collaboration tool involves evaluating how well it surfaces relevant capabilities—much like directing focused light toward the mechanisms that matter most for your workflow.

• What folders am I connecting, and do any contain credentials, financial documents, or personal records? Anthropic specifically recommends against connecting folders with financial documents, credentials, or sensitive personal information. Consider creating a dedicated working folder for Cowork rather than connecting your documents root.
• Do I have backups of the files I’m connecting? Cowork can write and delete files in connected folders. Deletion requires explicit permission, but writes do not. Back up anything you can’t afford to lose before connecting it.
• Which sites will Claude access through Chrome, and am I signed into any of them? Anthropic advises against using Claude in Chrome on sites where you’re signed in or that handle money or personal information. Be deliberate about which sites fall within the task scope.
• Is internet access scoped to sites I trust for this task? Cowork’s default allows broad web access. If the task doesn’t require general web browsing, consider whether you need to restrict that access.
• Which permission mode fits this task? Manual mode for anything touching sensitive accounts, new tools, or actions that are hard to reverse. Auto mode once you’ve seen how Claude handles a task type and the stakes are lower. Skip mode only when you understand the full task scope and the consequences of an unreviewed action.
• Am I monitoring the task or stepping away? Anthropic recommends watching for unexpected scope creep - Claude accessing files or sites you didn’t mention, or the task expanding beyond what you asked. If something feels off, stop the task immediately.
• Are the tools and plugins I’ve added to Cowork ones I trust? Cowork supports third-party connectors and plugins. The same prompt injection risk that applies to external websites applies to any tool that brings in external data.

The overarching principle from Anthropic’s documentation is worth keeping in mind: the impact of anything going wrong depends on two things - what Claude can read, and what Claude is allowed to do. Narrowing both is the practical control you have.

How BrainRoad Fits: A Different Point on the Same Spectrum

Claude Cowork and BrainRoad solve adjacent problems from different angles. Cowork is Anthropic’s product for running multi-step tasks within the Claude ecosystem - files, browser, apps - with the permission model described above.

BrainRoad is built around a different priority: a durable Business Brain - your files, notes, customer history, templates, rules, and service context - that any AI helper works from consistently, with review required before managed external actions go out. Where Cowork gives Claude broad access to your environment and asks you to configure safe boundaries, BrainRoad starts narrower: the AI works from the context you’ve explicitly organized, drafts the next step, and routes external actions through a review step by default. Owners can grant narrow, revocable auto-approval for eligible low-risk replies; higher-stakes actions stay manual.

BrainRoad does not host Claude Cowork and does not provide unrestricted computer control. If you’re evaluating personal AI assistant options that keep review in place before anything goes out, that’s the distinction worth understanding before choosing a path. You can explore the broader landscape of AI agent platforms to compare what each approach gives up and what it protects.

For more on what isolation means in practice and how to think about what’s protected in a hosted AI helper, the piece on why your AI agent needs its own workspace covers the underlying tradeoffs directly.

What This Means Before You Start Your First Cowork Session

• Claude Cowork is a multi-step knowledge-work agent - meaningfully different from Claude chat (conversational) and Claude Code (developer terminal tool). It is built for document production, research, file work, and cross-app coordination without requiring a developer setup.
• Cowork requires a paid plan. Pro starts at $20/month. Max plans at $100 and $200/month offer higher session capacity for heavier use. There is no free tier access.
• Remote session isolation protects your network and local machine from Claude’s code execution. It does not restrict what Claude reads or does through apps and folders you’ve explicitly connected.
• Three permission modes - Manual, Auto, and Skip - control how much Claude checks with you before acting. File deletion always requires a separate explicit permission regardless of mode.
• The SharedRoot vulnerability (July 2026) affected the local VM execution path, not the cloud execution default Cowork now uses. The researchers’ analysis points to four design-level mitigations that generalize beyond this specific CVE.
• The practical risk controls you hold are access scope (what Claude can read) and permission mode (what Claude can do). Narrow both before running a task with real files or signed-in accounts.

Frequently Asked Questions About Claude Cowork

Is Claude Cowork free?

No. Claude Cowork is available only on paid plans - Pro ($20/month or $200/year), Max 5x ($100/month), Max 20x ($200/month), Team, and Enterprise. The free Claude plan does not include Cowork access. As of late July 2026, Cowork on web and mobile is still rolling out in beta, starting with Max plan users.

What is Claude Cowork used for?

Cowork is designed for knowledge work that involves multiple steps and real outputs: research briefs, recurring reports, meeting prep summaries, polished spreadsheets and presentations, file organization, and tasks that span connected apps like Slack, Google Drive, and web browsing. It handles the execution work that a conversational AI tool leaves to you.

How is Claude Cowork different from Claude chat?

Claude chat is built around conversation, drafting, and file uploads. Cowork takes a multi-step task, plans the approach, works across connected tools and files, and produces a finished output. It can keep working while you step away, which creates a different permission and review problem than an ordinary chat.

What happened with the SharedRoot security issue?

In July 2026, researchers at Accomplish published a report demonstrating that untrusted content in a Cowork session could escape the local Linux VM sandbox on macOS and access the full host filesystem, including credentials and SSH keys. The vulnerability (CVE-2026-46331) was reported to Anthropic, which closed it as ‘Informative.’ Cowork now uses cloud execution by default, and the researchers state this local escape path does not appear to apply to cloud execution. If you’re running a configuration that still uses local VM execution, that’s worth reviewing.

How do I control what Claude Cowork can do?

Cowork offers three permission modes: Manual (Claude asks before each action), Auto (Claude self-reviews actions and blocks unsafe ones), and Skip (no checks). You can switch modes at any time. File deletion always requires explicit permission regardless of mode. Beyond mode selection, the most effective controls are limiting which folders you connect and which sites you allow Claude to access through Chrome.

Does Cowork need the Claude Desktop app?

Only if the task needs files or browser access on your own computer. Cowork sessions run remotely, so cloud-only work can run without the Desktop app. Local folders and Chrome access require the app to be open and connected.

Sources

• Use Claude Cowork safely - Anthropic Help Center
• Get started with Claude Cowork - Anthropic Help Center
• Choose a Claude plan - Anthropic Help Center
• The Claude Cowork product guide - Anthropic Blog
• Cowork Overview - Anthropic Developer Docs
• SharedRoot: Escaping the Claude Cowork sandbox - Accomplish Blog