Claude Cowork: The Ultimate Desktop Agent Guide

Cowork sits between Claude's standard chat interface and the terminal-based Claude Code. It is for knowledge workers who need Claude to take action on their behalf in a desktop GUI environment.

The distinction matters more than the marketing suggests. Chat is a conversation that produces text you then copy somewhere else. Cowork is a workspace you point at a folder, after which Claude reads the files, writes new ones, and reports back. Anthropic describes it as a dedicated surface inside the Claude desktop app where the assistant works across your applications, runs scheduled tasks and delivers finished output while you get on with something else.

Crucially, Chat, Code and Cowork all draw on a single subscription and a single usage allowance. There is no separate Cowork bill, but there is also no separate Cowork budget: a heavy afternoon of agentic file work eats into the same quota you would otherwise spend on Claude Code. That is the single most common surprise for new users.

Cowork did not arrive fully formed. It launched on 12 January 2026 as a macOS research preview, initially aimed at Anthropic's highest-tier subscribers, and spent the following three months broadening out.

The expansion has continued past the desktop. Anthropic has since taken Cowork beyond the laptop to mobile and the browser, so a task can be started on one device, monitored from another and collected when it finishes, rather than requiring a machine to be left awake. We cover those surfaces separately in our pieces on Cowork on mobile and Cowork in the browser.

The most dramatic consequence of Cowork's launch had nothing to do with product design. On 30 January 2026 Anthropic released eleven open-source plugins covering calendar management, document search, sales, financial analysis, legal review, marketing and customer support. Investors read that list as a map of the enterprise software market.

On 3 February the S&P Software & Services Index fell roughly 4 per cent, wiping out more than $285 billion (about £228 billion) in market value, while JPMorgan's software index dropped around 7 per cent. Individual names took heavier damage: LegalZoom fell close to 20 per cent and Thomson Reuters around 16 per cent, according to reporting collated by DeepLearning.AI's The Batch. The financial press promptly christened the episode the "SaaSpocalypse".

A second leg down followed on 20 February when Anthropic previewed Claude Code Security, which dented cybersecurity software names on the same logic. The recovery, such as it was, came on 23 and 24 February, when Anthropic announced integrations with Docusign, FactSet, Gmail, Intuit and Salesforce. The message investors took from that was more reassuring: Cowork's plugins would plug into incumbent software rather than simply replace it. The index rebounded, though not all the way.

It is worth being clear about what this episode does and does not prove. A share price move is a statement about expectations, not about whether a tool works. The sell-off showed that the market believes per-seat licensing is vulnerable to agents that can complete tasks end to end. Whether Cowork specifically is the thing that does the damage is a much longer argument, and one where proprietary data, regulatory obligations and embedded transactions still look like durable defences for the incumbents.

Stripped of the market drama, Cowork's competence is narrower and more practical than the headlines imply. It is at its best on tasks that are tedious, file-shaped and easy to verify.

• Turning documents into data. Pointing Cowork at a folder of receipts or invoices and asking for a tidy spreadsheet is the canonical demonstration, and it is a genuinely good fit: the input is messy, the output is structured, and errors are visible at a glance.
• File and folder housekeeping. Renaming to a convention, sorting by content rather than filename, and de-duplicating a download folder are all work that Cowork can do in a single pass.
• Scheduled and recurring jobs. Because tasks can be queued to run on a schedule, routine reporting becomes something that lands in a folder rather than something you remember to do.
• Standing instructions. Global and per-folder instruction files let you encode house style once, so Claude does not need to be re-briefed on every run.

The corresponding weaknesses are equally clear. Context is scoped to the workspace rather than following you across surfaces, there is no free tier, and everything runs through Anthropic's own models with no option to route a cheap subtask to a cheaper provider. If your workflow depends on any of those, Cowork is the wrong shape.

The February 2026 update transformed Cowork into a serious enterprise product with the launch of the plugin marketplace. Plugins are pre-configured bundles of skills and connectors tailored for specific departments.

The 24 February expansion was the substantial one. Alongside a wave of general knowledge-work plugins covering HR, design, engineering, operations and financial analysis, Anthropic added a dedicated financial-services set aimed at investment banking, equity research, private equity and wealth management, plus a batch of partner-built plugins and a dozen new connectors. That vertical push is the clearest signal of where Anthropic thinks the revenue is: not in generic office productivity, but in the document-heavy professional work where an hour of analyst time is expensive.

For enterprise IT teams, Cowork offers private marketplaces, auto-installation of approved plugins, and OpenTelemetry support for monitoring usage and costs.

Cowork uses the Model Context Protocol (MCP) to connect to external data. A significant addition is the unified Microsoft 365 connector, providing access to Word, Excel, PowerPoint, OneDrive, and SharePoint.

The Microsoft 365 connector arrived on 13 February 2026 and lets a Cowork session read Outlook mail, OneDrive and SharePoint documents, and Teams chat history from inside a desktop task. It is deliberately read-only in its initial form: Claude can search and summarise across drives, sites, threads and channels, but the write path runs through the Excel and PowerPoint add-ins that followed a week later rather than through the connector itself. Anthropic has made the connector available across every plan tier, free included, which is unusual for an enterprise integration and tells you how central it is to the pitch. We go deeper on setup and permissions in our Microsoft 365 connector guide.

Because connectors are MCP servers, the list above is a floor rather than a ceiling. Anything that speaks the Model Context Protocol can be attached, which is how the partner plugins released in February work and why the practical integration surface grows faster than Anthropic's own announcements.

On 9 March 2026, Microsoft announced "Copilot Cowork," bringing Claude Cowork's technology directly into Microsoft 365 Copilot. This represents a massive shift, allowing Claude to work within M365's security and compliance boundaries.

Copilot Cowork bundles Claude with identity management tools in the new $99 (£79) per user E7 tier, positioning Claude as a mainline reasoning engine alongside OpenAI's models (while Anthropic keeps experimental frontiers like Claude Mythos Preview strictly internal).

The E7 licence is not a Claude subscription with a Microsoft badge. It bundles Microsoft 365 E5, Microsoft 365 Copilot, Agent 365 and the Entra identity suite into a single per-seat price, with Copilot Cowork as the headline capability. Microsoft put the tier on sale from 1 May 2026, having announced it as the centrepiece of a broader Copilot platform wave on 9 March. Copilot Cowork itself started life in research preview, with wider access arriving through Microsoft's Frontier early-access programme later that month.

Strategically, this is the more interesting half of the Cowork story. Anthropic gets distribution into organisations that will never install a third-party desktop agent, and Microsoft gets an agentic capability it can sell at a premium without waiting for OpenAI. The trade-off for Anthropic is that the customer relationship, and the governance layer, belongs to Microsoft.

An agent with filesystem access and network connectors is a fundamentally different risk object from a chatbot, and Anthropic has been reasonably candid about it. The company's own guidance warns that Cowork can take destructive actions, including deleting files when an instruction is ambiguous, and that it is vulnerable to prompt injection delivered through the documents and websites it reads.

That was not a theoretical concern. Within days of the January launch, researchers at PromptArmor demonstrated a full attack chain in which a Word document carrying hidden instructions caused Cowork to upload a user's financial files to an attacker-controlled Anthropic account. The mechanism is instructive: code Claude executes runs in a sandbox that blocks outbound requests to almost every domain, but the Anthropic API is on the allow-list, so exfiltration through that trusted channel slipped past the network controls.

Anthropic's own defences combine model-level training to refuse instructions embedded in content with classifiers that scan untrusted material entering the context window. The company is explicit that neither reduces the risk to zero. For regulated organisations, that honesty is the point: Cowork is a tool to pilot under supervision on non-sensitive data first, not something to hand the finance share drive on day one.

Cowork is included in all paid Claude plans. There is no separate subscription fee.

The number that matters is not the headline price but the usage allowance behind it. Because Chat, Code and Cowork share a single pool, a Pro seat that comfortably covers daily conversational use can be exhausted in an afternoon of agentic file work. Anyone planning to lean on Cowork as a routine part of their day should budget for Max rather than Pro, and teams should pilot on a handful of seats before committing to a per-seat rollout.

Our overall read: Cowork is the most convincing consumer-facing agent shipped so far, and also the one with the widest gap between demo and daily reality. Use it where the output is checkable, keep it away from anything you cannot afford to have read by a document you did not write, and treat the SaaS sell-off as a statement about expectations rather than a verdict already delivered.