Anthropic Cowork Mode: Desktop AI Agent Architecture Explained

Anthropic Cowork mode is a research preview that transforms Claude from a chat interface into a desktop automation agent. Unlike Claude Code—which targets developers with terminal-based coding workflows—Cowork tackles file operations, browser automation, application control, and task scheduling for knowledge workers who need an AI agent that understands their workspace. The Anthropic Cowork mode architecture combines a sandboxed execution layer, progressive-disclosure skills system, plugin ecosystem, and tiered computer-use permissions to give Claude safe, constrained access to your desktop and filesystem. This post unpacks how Cowork mode actually works: the core system layers, MCP integration, plugin model, computer-use tier enforcement, and where it diverges from Claude’s other agent surfaces. What this post covers: the reference architecture, plugin and skill anatomy, computer-use enforcement, trade-offs, and when to use Cowork versus Claude Code.

What Cowork Mode Actually Is

Cowork mode started as Anthropic’s answer to a specific problem: Claude excels at reasoning about files and automating tasks, but the desktop remains mostly off-limits. Claude Code handles terminal workflows for developers, but most workers operate in graphical applications, web browsers, and file systems that exist outside the command line. Cowork bridges that gap.

Cowork is not a separate product. It’s a research preview bundled with the Claude desktop app—available since early 2026—that activates a complete agentic surface alongside the standard chat interface. When you use Cowork, you’re running Claude Sonnet or Opus through a dedicated execution pipeline optimized for task automation: long-running operations, stateful sessions, safe file I/O, and measured computer access.

The key architectural principle is progressive disclosure with explicit permission. Users approve which applications Claude can interact with—granted at entry time via a dialog—and within those applications, Claude operates at one of three tiered permission levels (read-only for browsers, clickable for terminals, full for everything else). Skills, plugins, and tools load only when semantically relevant; a skill’s full markdown definition doesn’t load until Claude determines it applies to the user’s request. This lazy-loading approach keeps startup latency low while ensuring Claude always has the right context when it matters.

Cowork mode is built on the Anthropic Agent SDK, the same foundation powering Claude Code, but the UX and constraints differ significantly. Cowork prioritizes non-developers and emphasizes safety through tight sandboxing: code runs in isolated Linux VMs, file operations are constrained to mounted directories, and shell access requires explicit user approval per command. In contrast, Claude Code assumes the user is a developer comfortable with terminal commands and trusts the developer to manage risk.

The Cowork surface is not meant to replace the browser or your task manager. It’s a dedicated agentic layer that sits between your intent and your desktop, learning your workflows, automating routine tasks, and bridging gaps where no API or existing tool exists.

Cowork Mode Reference Architecture

The Anthropic Cowork mode architecture is organized into five horizontal layers, each responsible for a discrete concern:

Layer 1: User Interface. The Cowork surface in the Claude desktop app presents a chat-like interface similar to standard Claude, but with additional UI affordances: a task history sidebar, recent files or projects, a skills panel showing installed slash commands, and an artifacts panel for persistent HTML widgets. Unlike web Claude, the desktop app has no rate limiting, supports larger context windows, and keeps conversation state in local storage, not on Anthropic’s servers.

Layer 2: Claude Model (Reasoning). Requests hit Claude Sonnet (by default; users can upgrade to Opus) running against the latest training data. The model is stateless—it reasons over the conversation history, loaded skills, connected MCP servers, and available tools, then decides what to do next. This is standard Claude inference, but with one key difference: the model is instructed that it’s operating in Cowork mode and has access to specific tools and permissions that chat-only Claude lacks.

Layer 3: Tools and Connectors. Cowork provides a standard tool layer: Read, Write, Edit, and Glob for file operations; Grep for text search; and bash for sandboxed shell commands. These map directly to host filesystem operations, mounted at a VM path (e.g., /sessions/<session-id>/mnt/your-folder). Connectors are pre-built integrations with SaaS platforms: Gmail, Slack, Google Calendar, Linear, Asana, and others. Each connector exposes a small API (list messages, send reply, fetch calendar events) without requiring the user to manage API keys—authentication happens once via OAuth, and Cowork handles token refresh.

Layer 4: MCP Servers and Plugins. The Model Context Protocol (MCP) is Anthropic’s open standard for connecting tools to Claude. MCP servers are standalone HTTP services that expose tools via a JSON-RPC interface. Cowork bundles three first-party MCP servers: computer-use (for GUI automation), Chrome (for browser control), and workspace (bash + file I/O with health checks). Third-party MCP servers—both open-source and vendor-built—can be registered and exposed to Claude. Plugins bundle MCP servers, skills, slash commands, and configuration into a single installable unit. A plugin might include an MCP server that talks to a proprietary API, five skills (markdown files describing capabilities), two slash commands (short macros), and integration hooks for events like “on message received” or “on artifact created.”

Layer 5: Constraints and Sandboxes. Every Cowork session runs in an isolated Linux container. File I/O is scoped to mounted folders (declared by the user via request_cowork_directory). Shell commands inherit the sandbox environment—network access is restricted, home directory is ephemeral, and process isolation prevents commands from interfering with the host OS. Computer-use MCP enforces a frontmost-app check: if the active application is a browser, Claude can only read the screen; if it’s a terminal or IDE, Claude can click but not type; otherwise, Claude has full control. This tiered enforcement happens at the API level—left_click errors if the app tier forbids it.

The flow from request to response looks like this:

User asks “Summarize my emails from today.” Claude reasons that this requires Gmail access. It loads the “Gmail connector” skill from disk (progressive disclosure), which describes available operations (list messages, search, fetch thread). Claude calls the Gmail MCP tool with parameters (query = “is:unread after:today”), receives a list of message previews, and synthesizes a summary back to the user. The entire flow is observable in the chat transcript.

Plugins, Skills, and the MCP Layer

Understanding Cowork’s plugin model requires understanding three distinct concepts: skills, plugins, and MCP servers. Many newcomers conflate them.

Skills are markdown files (SKILL.md) that define a capability Claude can activate. A skill has a short description (1-2 lines) that lives in an index file and is always loaded; the full markdown body—which includes examples, related commands, warnings, and step-by-step procedures—is fetched lazily. When Claude determines a user request is relevant to a skill, it loads the full SKILL.md, reads the procedures, and can then execute the skill’s commands or call associated tools. Skills are meant to be human-readable, progressively disclosed (only the index is always resident), and composable. A user might have 50 installed skills, but only 3-5 are loaded per conversation depending on context relevance.

Plugins are installable packages that bundle skills, MCP servers, slash commands, and configuration. A plugin is a directory with a plugin.yaml manifest describing its contents, plus subdirectories for skills and MCP servers. When a user installs a plugin from a marketplace, Cowork downloads the directory (or syncs it from a Git repo), registers all MCP servers in plugin.yaml, and indexes all skills for progressive disclosure. Plugins are how third-party developers monetize or open-source integrations. A “Sales automation” plugin might include an MCP server that talks to Salesforce, five skills for pipeline analysis, and slash commands like /pipeline-forecast and /win-rate.

MCP Servers are the heavy-lifting layer. An MCP server is an HTTP service (often local, sometimes remote) that exposes tools via JSON-RPC. Cowork’s first-party MCP servers include:

• Computer-use MCP: exposes tools like screenshot, left_click, type, scroll, and read_page. This is the GUI automation layer. Every tool call includes a frontmost-app check that returns a tier (read/click/full) and errors if the action violates the tier.
• Chrome MCP: specialized browser control—DOM-aware clicks, form filling, JavaScript execution, network request inspection. Faster and more reliable than raw computer-use clicks for web apps.
• Workspace MCP: bash, Read, Write, Edit, Glob, Grep. Filesystem operations scoped to mounted folders. Health checks prevent catastrophic operations (e.g., rm -rf /).

Third-party MCPs can be registered in plugin.yaml and will appear in the tool namespace. For example, a Stripe MCP might expose tools like create_invoice, list_charges, and refund_transaction. The MCP contract is simple: tools have names, descriptions, and schemas. Claude calls them by name with parameters, and the MCP returns results.

The plugin container is where the magic happens. A plugin isn’t just a collection of loose files; it’s a unit of composition. Installation registers all MCPs, indexes all skills, binds all slash commands to a handler dispatcher, and sets up event hooks (e.g., “when a user clicks artifact X, call this MCP tool Y”). Cowork ships with a plugin marketplace where creators can upload .plugin archives. Marketplace plugins are sandboxed: they run as separate processes, communicate via MCP, and cannot directly access the Cowork host process.

This architecture enables a vibrant ecosystem. A third-party team can build a Jira MCP + accompanying skills, package it as a plugin, list it on the marketplace, and reach thousands of Cowork users—all without Anthropic shipping updates or vetting the code against Cowork’s internal codebase.

Computer Use, Tiered App Access, and Sandboxes

Computer-use is the crown jewel of Cowork, but it’s also the riskiest surface. Anthropic solved the safety problem through tiered app access and sandboxing.

When you launch Cowork, the first time you make a request involving GUI automation, the app asks you to grant access to the applications you want Claude to control. You might approve Terminal, VS Code, and Google Chrome, but deny access to Mail and 1Password. This approval is stored locally and persists across sessions. Subsequent computer-use requests check the approval list: if Claude tries to interact with an unapproved app, the MCP tool errors and Claude is prevented from proceeding.

The tier system adds another layer of control:

• Read-only (tier: read): Frontmost app is Safari, Chrome, Firefox, or another browser. Claude can take screenshots and read page text, but left-click and type are blocked. For browser automation, you must use the Chrome MCP (which is DOM-aware and faster anyway).
• Click-only (tier: click): Frontmost app is Terminal, VS Code, PyCharm, or another IDE. Claude can left-click, scroll, and read the screen, but cannot type or right-click. This prevents Claude from accidentally executing a shell command or deleting code. For shell commands, you direct Claude to use the bash tool instead.
• Full (tier: full): Everything else (Maps, Notes, System Settings, Finder, Notion, Slack). Claude has unrestricted mouse and keyboard control.

The tier is determined at tool-call time, not at approval time. This means the tier can change within a single conversation. You might start with Terminal in front (tier: click), then switch to Finder (tier: full). Claude’s computer-use tools will seamlessly adapt: attempts to type in Terminal will error and Claude will route to bash; attempts to type in Finder will succeed.

Sandboxing is the second pillar of safety. Cowork runs every conversation in an isolated Linux container. Your mounted folder (e.g., C:\Users\YourName\My Projects) appears at /sessions/<session-id>/mnt/My Projects inside the container. Bash commands execute inside this container, not on your host OS. Network access is restricted—bash cannot reach the internet, only your local network. Process isolation prevents one conversation from interfering with another. If a skill or plugin runs a malicious bash command, it’s contained: it might consume CPU or disk inside that conversation’s container, but it cannot modify system files, steal credentials, or impact other sessions.

File I/O tools (Read, Write, Edit) are scoped to your mounted folders. If you try to read /etc/passwd, the tool errors. If you try to write to /, it errors. This constraint is enforced in the MCP layer, not the bash layer, so it applies whether you’re using the tool directly or indirectly via a plugin.

The three-layer safety model—approval, tiering, and sandboxing—means Cowork can offer powerful desktop automation without requiring you to run untrusted code on your host machine. A plugin from a third-party vendor is sandboxed the same way as Anthropic’s first-party code.

Trade-offs and Where Cowork Falls Short

Cowork is powerful but not unlimited. Understanding its constraints is critical before building workflows around it.

Latency and Asynchrony. Computer-use actions (screenshot, click, type) incur round-trip latency: the request goes to the MCP, waits for the host OS to process it, and returns. A single click takes 200–500ms. A complex GUI automation—fill a form, submit, wait for page load, extract results—can take 10–30 seconds. This works fine for one-off tasks (“download this PDF”) but breaks down for high-frequency interactions. Cowork is not suitable for real-time gaming, video editing, or intensive data-entry workflows.

Reliability and Fragility. Cowork’s computer-use layer depends on successful GUI parsing. If a web page’s HTML changes, DOM selectors break. If a native app’s layout shifts, pixel-based clicking fails. Cowork includes error recovery (retry logic, fallback strategies), but complex multi-step workflows are fragile. You cannot expect Cowork to reliably navigate a website that’s under active development or uses highly dynamic rendering.

Limited AI Context. Claude’s context window is large (200K tokens) but finite. A complex automation task might require loading dozens of files, understanding a workflow, and executing a sequence of steps. Cowork is optimized for focused, narrowly-scoped tasks, not open-ended learning. If your workflow requires understanding 500 pages of documentation, traditional documentation search might be more practical.

No Local LLM. Cowork runs Claude Sonnet or Opus on Anthropic’s servers (with an enterprise option to self-host). All conversation text, screenshot descriptions, and reasoning are sent to the API. If your data is highly sensitive, on-prem deployment is available but requires enterprise licensing. For consumer users, data privacy is a trade-off for convenience.

Incomplete Ecosystem. While the plugin marketplace is growing, coverage is patchy. Popular SaaS platforms (Slack, Gmail, Asana) have connectors. But niche tools, internal company systems, and legacy software often lack MCP servers. For those cases, you fall back to screen scraping via computer-use, which is slow and fragile.

No Code Execution Outside Sandbox. Unlike Claude Code, Cowork cannot directly run Python, Node, or Ruby on your host machine. All code execution happens in the sandbox. This is safer but limits Cowork’s ability to integrate with your local development environment.

Cowork vs Claude Code — When to Pick Which

Anthropic offers two agentic surfaces: Cowork and Claude Code. They serve different personas and workflows.

Claude Code is for developers. The primary surface is the terminal. The default tools are bash, Read, Write, Edit, Grep—everything a developer needs to write, test, and debug code. Code assumes you trust Claude to run arbitrary commands in your development environment. There’s no app-access approval dialog; Claude can execute npm install, git push, or python train.py without asking. This is the right model for a developer who’s reviewing PRs or debugging a failing test.

Cowork is for knowledge workers, analysts, and automation enthusiasts. The primary surface is the chat interface. The default tools are file operations, connectors (Gmail, Slack, Asana), and browser automation. Cowork enforces safety through explicit approval dialogs, tiered computer access, and sandboxing. You trust Claude to help with your work, but you verify permission boundaries upfront.

The choice is context-dependent:

• Use Claude Code if: you’re writing code, debugging, running tests, or managing a Git repository. You’re comfortable with bash and expect Claude to suggest shell commands. You want maximum speed and minimal friction.
• Use Cowork if: you’re not writing code, or you are but you want Claude to also automate GUI tasks (fill forms, control Slack, manage files). You want safety guardrails and explicit permission approval. You’re less comfortable with bash and prefer a conversational interface.

In practice, many workflows blend both. You might use Claude Code to write a script, then Cowork to schedule its execution or integrate it with your task manager. The two surfaces are complements, not competitors.

Frequently Asked Questions

Does Cowork send my desktop screenshots to Anthropic servers?
Yes. Screenshot data, application names, and window text are sent to Claude for reasoning. Anthropic encrypts data in transit and deletes conversation records after 30 days (enterprise plans can request longer retention). If your work involves highly sensitive data (military, medical, financial), on-prem deployment is available under Anthropic’s enterprise license.

Can I run code in Cowork?
Only in the sandbox via the bash tool. You can run Python, Node, or any interpreter installed in the container. Code runs isolated from your host; it cannot interfere with your system or other sessions. For full access to your local Python environment (pip packages, virtual envs, GPU), use Claude Code instead.

How do I know if a plugin is safe to install?
The Cowork plugin marketplace includes creator reputation scores, user reviews, and code provenance. Plugins run sandboxed, so even malicious code cannot escape to your host OS. That said, a plugin could consume disk, CPU, or network within the sandbox, or make API calls on your behalf. Read reviews, check the creator’s history, and consider the plugin’s access requirements (what MCPs and permissions does it request?).

Can Cowork access my local database or API server?
Yes, via the bash tool or custom MCP servers. Cowork’s sandbox can reach your local network (localhost:5432, 192.168.x.x). If you build a custom MCP server that talks to your database, you can register it as a plugin and Cowork will have access. However, this should only be done if you’ve reviewed the security implications.

What’s the difference between Cowork and the Chrome extension?
The Claude extension for Chrome is a lightweight browser companion—it can send web page text to Claude and execute basic highlighting or summarization. Cowork is a full desktop agent with sandbox shell access, file I/O, application control, and plugin ecosystem. The Chrome extension is a tool within Cowork; Cowork is not a tool within the Chrome extension.

Further Reading

Internal Links:
– Model Context Protocol Architecture — Deep dive into MCP’s request-response model, tool schemas, and how MCPs compose in the Cowork ecosystem.
– Claude Skills Architecture: Dynamic LLM Agents — Explore how skills are indexed, progressively disclosed, and composed into complex workflows.
– Claude Computer Use Architecture: LLM Desktop Agents — Technical breakdown of GUI automation, tier enforcement, and sandboxing.

External Resources:
– Anthropic Documentation — Official guides on Cowork mode, MCP, and plugins.
– Model Context Protocol Specification — The open standard defining how tools connect to Claude.

By Riju · iotdigitaltwinplm.com