Claude Cowork Architecture Explained — Remote vs Local Execution & Security Isolation

Claude Cowork — the feature that lets an AI agent read files, execute code, and handle multi-step tasks on your behalf — is currently in beta, rolling out starting with the Max plan on web and mobile. This guide, based entirely on Anthropic's official support documentation, explains where Cowork actually runs, how your data is isolated in each mode, and what controls administrators have to restrict its scope. It is written for Enterprise admins and anyone new to Cowork who wants to understand the architecture before using it.

Two Ways Cowork Can Run

According to the official documentation, Cowork operates in two distinct modes: remote sessions and local sessions. Remote execution is now the default direction for new deployments and is rolling out gradually; local execution continues to be available for existing desktop deployments. The mode determines where the agent's work is processed and how isolation is enforced.

Remote Sessions — Running on Anthropic's Servers

In a remote session, the agent loop — the core sequence in which Cowork handles your conversation, reads files, and executes code — and all code execution run inside an isolated, temporary sandbox on Anthropic-managed infrastructure. A sandbox — think of it as a sealed temporary workspace that is created fresh at the start of a session and destroyed when it ends — does not share any state with other sessions or other organizations.

The official documentation lists the following key security properties of a remote session.

• No network access by default. The sandbox cannot reach private or internal networks, cloud-metadata addresses, or Anthropic-internal systems. For Enterprise organizations, no network access is the default.
• Mandatory egress proxy. All traffic leaving the sandbox must pass through a proxy that the sandbox itself cannot reconfigure or bypass. Only allow-listed destinations can be reached.
• Short-lived credentials only. The sandbox holds only session-scoped tokens that expire within hours. Connector — an integration module that links Cowork to an external service — authorization tokens never enter the sandbox; those calls are handled on the server side.
• Tenant isolation. Every stored record is scoped to your organization and account only.

When a remote session needs something on the user's device — such as a local file or the browser — the request travels through the Claude Desktop app over an Anthropic-brokered connection. Local file access is limited to folders the member has explicitly connected in the desktop app, and each local tool call is checked against that member's permissions before it runs. If the Desktop app is offline, the remote session cannot reach the device.

Important note: Because a remote session runs on Anthropic's servers, the agent's work — including any local files it opens through the Desktop app — is processed on Anthropic's servers rather than staying on the device. Per the official documentation, conversation data for Team and Enterprise is handled under the same commercial commitments as other data and is not used to train Claude.

Local Sessions — Running on the User's Device

Local sessions apply to existing desktop deployments and use two separate execution environments, both on the member's device.

• The agent loop runs natively on the device. This includes conversation handling, reading and writing files in connected folders, web fetches, and local plugin MCP servers — MCP stands for Model Context Protocol, the standard that governs how Claude connects to external tools. An application-layer permission system enforces the member's folder rules and the organization's network egress settings.
• Code execution runs inside an isolated virtual machine (VM) — a self-contained virtual computer that runs independently within the device. Shell commands and any code Claude writes execute only inside this VM. On macOS, Apple Virtualization.framework provides the isolation from the host OS; on Windows, Hyper-V does the same job. The VM enforces its own network egress filtering, system-call restrictions, and per-session user isolation.

Admin Controls

According to the official documentation, Cowork's management controls are split across two layers: organization settings and device-level MDM settings. Understanding which layer does what prevents confusion when rolling out restrictions.

What Organization Settings Control

The master switch that enables or disables Cowork for an entire organization is found at Organization settings › Cowork › Enable for your organization. Turning this off deactivates Cowork regardless of any device-level settings.

Beyond the master toggle, organization settings let admins manage remote sessions specifically.

• Turn remote sessions on or off for the whole organization — local desktop Cowork can remain available while remote sessions are blocked.
• Set the network-access policy that determines which destinations a remote session can reach.
• Turn off the persistent "always allow" option, requiring fresh approval for every permission-gated tool call, and control whether members can run sessions without per-call approval prompts.

Device-Level MDM Settings (Team and Enterprise)

MDM — Mobile Device Management, a solution organizations use to configure and enforce policies on employee devices from a central console — gives admins two keys to restrict Cowork's scope on managed devices. These settings are applied through your MDM solution at the device level, not from the organization settings dashboard.

• Set isLocalDevMcpEnabled to false to disable plugin-bundled and locally configured MCP servers.
• Set isDesktopExtensionEnabled to false to block MCPB — MCP Bundle, a packaged extension format — and DXT — Desktop eXTension, the desktop extension server format — from running.

⚠ Key point to watch: These MDM keys govern the Claude Desktop app, so they affect not only local sessions but also anything a remote session reaches through the Desktop app. Additionally, local MCP servers do not run in remote sessions at all. Device-level settings only matter when Cowork is enabled at the organization level — if the organization toggle is off, no device setting can re-enable Cowork.

What Changed in the Desktop App (macOS & Windows)

This update applies to the desktop app alongside the web and mobile expansion. Chat and Cowork now share one home: you select “Cowork” in the same message box to hand off a task, and switch back to “Chat” anytime. Because sessions run remotely (in beta), work you start on desktop can be checked from web or mobile, and sessions keep running even when the app is closed or your computer is asleep.

For Windows users specifically:

• Update to the latest version — the new Cowork requires the latest version of Claude for Windows. Download or update at claude.com/download (per the official support docs).
• Keep the app open for local access — sessions run remotely, but anything that reaches your machine — local file access, browser use, and computer use — needs the desktop app (macOS or Windows) open and connected.
• Computer use works on Windows — Cowork’s computer use has been available on Windows since April 2026 (per Anthropic’s official announcement): opening apps, navigating your browser, and filling in spreadsheets.

Scope of This Guide and Next Steps

Everything in this guide is drawn solely from Anthropic's official support documentation at support.claude.com. Because Cowork is in beta and rolling out gradually, the exact screens, menu labels, and available plan tiers may change. Always verify the precise setting names and paths in your organization's actual dashboard. For the full details on applying MDM keys, refer to the Enterprise configuration for Claude Desktop section in the official documentation.

Related articles

• What Is Claude Cowork? Claude's File-Working Desktop Mode
• Claude Chat Projects vs. Cowork Projects — What Carries Over (Tested)
• Claude Chat vs. Cowork — Which One for This Task? A Simple Decision Guide
• Claude Projects, Artifacts & Memory: What They Are and How to Use Them
• How to Write Prompts for Claude: 6 Core Principles from the Official Docs