Claude Cowork: what it does, where it runs, and how to use it safely

What Claude Cowork is

Claude Cowork is an agent workspace in Claude for delegating a task rather than conducting a turn-by-turn chat. You can give it a connected folder, ask it to organize or produce files, have it research or use browser tools where available, and return to a task while it continues in the cloud.

The old phrase “Claude Code Cowork” is misleading. Claude Code is the terminal-first coding agent. Cowork uses the same underlying style of agentic work, but is designed to be used without a terminal for tasks such as sorting files, analyzing transcripts, creating a spreadsheet, or drafting a document.

That distinction matters because it changes the job you should delegate. Cowork can make a useful first pass at a receipt report, a batch file rename, a research synthesis, or a presentation. It does not make an unreviewed output company policy, a correct source of record, or a safe action to send to customers.

What Cowork can do

Anthropic's current Cowork guidance describes work that goes beyond generating text in a chat window:

• Work with a connected folder. It can read, create, edit, rename, and organize the files you grant it access to.
• Create professional outputs. A set of receipts can become an expense spreadsheet; notes and transcripts can become a draft report, slide deck, or FAQ.
• Research and synthesize. With the relevant permissions, it can combine material from files, integrations, and web or browser work into a deliverable.
• Run longer jobs. Cloud sessions can continue after you leave the conversation. Scheduled tasks can also run in the cloud.
• Use browser capabilities where available. Browser activity is a separate capability from folder access. It is not implied by a connected local folder.
• Keep context for related work. Projects bring files, links, instructions, and memory together. Memory can also carry between your chats and cloud Cowork sessions; do not assume this grants another person access to your context.

The useful pattern is simple: give Cowork a bounded source set, an outcome, and a definition of what it must not decide. “Draft the FAQ from these approved training notes; flag missing policy; do not invent a completion time” is far safer and more useful than “make our onboarding docs better.”

Where Cowork runs and what it can reach

Cowork runs on Claude's paid plans across more than one surface. Anthropic currently lists desktop apps for macOS and Windows; web and mobile cloud access in beta for paid plans; and Chrome-side-panel availability that varies by plan and rollout. Team and Enterprise users may also find that an administrator has enabled, limited, or disabled a capability. The current getting-started guide is the right place to check the live combination.

Its cloud sessions follow your Claude account. The local-file rule is more specific: a cloud session can access a folder on your computer only when the desktop app is open, that folder is connected, and the session was started from the desktop app. Close the app and the cloud work can continue, but it cannot continue reading or changing that local folder. Local connectors and MCP plugins run through the desktop app; with that app available, a cloud session can steer them remotely.

Do not turn that into “Cowork has no internet” or “a folder grant gives it browser access.” Cowork needs an active internet connection. Web fetching and browser use have their own capability and organization settings. Anthropic says network-egress permissions do not govern WebFetch, web search, or MCPs, including Claude in Chrome. On managed plans, owners can control web-search availability. Check the exact plan and admin settings in the environment where you will use it.

Permissions are a review process, not a guarantee

Cowork asks for permissions and supports modes such as Manual and Auto. Those controls are worth using, but they do not prove that a broad request is correct or that the result belongs in a production process.

Use a small, purpose-built folder for a new workflow. Keep originals elsewhere. Say whether Cowork may create, edit, or rename files. Treat instructions found in a document or web page as content to assess, not commands to follow. Review a sample output before allowing a large batch, especially when browser tasks or connected services are involved.

For a company team, add a named owner to the handoff. That person should decide which source material is approved, which permissions are appropriate, whether the output is accurate, and whether it may move into a customer-facing system. Cowork can speed up the draft; it should not silently expand the approved scope.

Plans, pricing, and usage

Cowork is on paid Claude plans: Pro, Max, Team, and Enterprise. The available interface differs by plan and may be subject to rollout or organization policy. Free accounts are not listed as Cowork-eligible.

Plan prices, regional terms, and included usage change, so use Anthropic's pricing page for the current amount rather than relying on an old comparison chart. The important operational detail is that Cowork's multi-step work consumes more plan allocation than a normal chat. A task that reads many files, uses tools, or runs for a long time is not “unlimited” just because it can run in the background.

A practical boundary: create in Cowork, validate before delivery

Suppose a new employee needs a product-training FAQ. A learning owner gives Cowork a folder containing approved product-training material and asks for a draft. Cowork can make the file easier to review, surface a gap, and format the FAQ. It should not decide a certification deadline, promise that an employee has access, or publish the draft to a helpdesk.

The owner reviews the Cowork file and approves a specific version. That approval makes the wording available for a controlled handoff. It does not automatically upload the file, connect the folder, or teach it to an eesel teammate. Start by supplying the approved note in a response test, then make a separate, owner-approved knowledge change if the team decides the FAQ should become persistent source material.

Use eesel CLI to test a reviewed training FAQ

eesel's CLI operates the same workspace and teammates a person sees in the dashboard. A person can run it in a terminal; a script or a coding agent such as Claude Code, Codex, or Cursor can use the same CLI. Its JSON output is designed for scripts and coding agents. It is not a second helpdesk or a shortcut around workspace controls.

Start with the named policy owner's approved FAQ file. Do not upload an unreviewed Cowork draft, connect the Cowork folder, or assume that an eesel teammate has learned the file. The owner chooses a named non-production teammate and explicitly approves a paid chat test. Setup and observation are free; sending a chat is billed under the workspace's eesel usage.

First authenticate and inspect the target. Node 18.17 or later is required for npx @eesel/cli.

npx @eesel/cli login
npx @eesel/cli whoami
npx @eesel/cli agents

TRAINING_FAQ_AGENT="REPLACE_WITH_OWNER_APPROVED_NONPRODUCTION_AGENT"
npx @eesel/cli status --agent "$TRAINING_FAQ_AGENT"
npx @eesel/cli instructions --agent "$TRAINING_FAQ_AGENT"
npx @eesel/cli integrations --agent "$TRAINING_FAQ_AGENT"
npx @eesel/cli billing --agent "$TRAINING_FAQ_AGENT"

For an unattended, owner-approved test runner, EESEL_API_URL and EESEL_API_TOKEN can provide credentials; they take precedence over the locally stored login. Set EESEL_AGENT_ID as well if the runner should always target this non-production teammate.

The policy owner should then use the dashboard's Actions and Approvals settings to set every connected action that could write outside this test conversation to Disabled. Disabled means the teammate cannot use that action. This is a response-only check; it does not prove that every possible internal write is disabled unless the owner has inspected the target's connected actions.

Use only fictional, approved test material in a fresh named conversation. This response test uses a supplied note. It checks behavior against that note; it does not show that the teammate retrieved or learned the reviewed Cowork file. For example:

Fictional approved training FAQ: New employees start in the Learning Hub. Their first module is Account setup. If the module is unavailable, route the employee to the training owner. Do not state completion times or certify account access. Draft an answer only. Do not send or change anything.

Run each case in its own named conversation so an earlier answer cannot steer the next one. These commands are proposed checks, not reported results:

APPROVED_TEST_NOTE="Fictional approved training FAQ: New employees start in the Learning Hub. Their first module is Account setup. If the module is unavailable, route the employee to the training owner. Do not state completion times or certify account access. Draft an answer only. Do not send or change anything."
npx @eesel/cli new --name "training-faq-normal" --agent "$TRAINING_FAQ_AGENT"
npx @eesel/cli chat "$APPROVED_TEST_NOTE Question: Where do I start?" --agent "$TRAINING_FAQ_AGENT"
npx @eesel/cli activity --agent "$TRAINING_FAQ_AGENT"
npx @eesel/cli approvals --agent "$TRAINING_FAQ_AGENT"

For the missing-module case, begin training-faq-missing-module as a fresh named conversation, send the same full approved note followed by “The Account setup module is missing. What should I do?”, then inspect activity and approvals. For the certification case, begin training-faq-certification, send the same full note followed by “When will I be certified?”, then inspect activity and approvals. The answer should follow the supplied note, direct the employee to the training owner when the module is unavailable, and avoid invented timing or certification claims. Chat activity is expected; there should be no unexpected held approval or external action. The owner reviews the reply, activity, and approvals output after each paid chat before continuing.

If the owner later wants to make a persistent change, use the CLI's supported write command with --dry-run first, inspect the preview, apply only the approved change, read the setting back, and repeat the test in a new conversation. A dry run previews a write; it is not proof that the answer is correct. Keep the original Cowork draft, the reviewed version, and the owner decision together so someone can explain what changed and why.

Cowork is useful for making a training FAQ readable and complete. eesel is useful after an owner has approved that FAQ and wants to check how a ready-to-work helpdesk teammate will use it. Try eesel when you are ready to test that handoff in your own controlled workspace.