The agent that works on your files, your inbox and your calendar: planning, connectors, Computer Use, scheduled tasks and the roles that bound them.
Install Cowork and connect your first workspace
Cowork requires a paid plan (Pro, Max, Team, or Enterprise); local files, browser use, and computer use additionally require the Claude Desktop app for macOS or Windows, open and connected. A first task follows four steps: open Claude, select Cowork, describe the task, review Claude's approach before letting it run. A Cowork project bundles folders, standing instructions, links, and a persistent memory store; it lives only on your computer, unlike a claude.ai project which is not tied to local folders and can be shared on Team and Enterprise. Create a project from Projects in the left navigation, then attach folders and instructions; global instructions apply everywhere, folder instructions are project specific.
Claude Cowork: the digital coworker
Cowork = desktop agent that acts on your files (read/edit/create/organize). Same foundations as Claude Code, non-technical audience. You describe the goal; it plans and executes the steps alone.
What Cowork can and cannot touch
Files: limited to connected folders, but inside them Claude can read, write, and permanently delete; it always asks before deleting, in every approval mode. Applications: Claude in Chrome reads the web, email, and connected apps; computer use clicks and types on your actual screen and has no sandbox between Claude and what is on screen. Network: sessions run in an isolated, temporary environment that cannot reach your home or company network, but isolation protects your machine, it does not limit what Claude can do with the access you granted. Prompt injection needs two things at once, Claude reading untrusted content and Claude then acting on it; narrowing folders, apps, and network access removes one half of that chain.
Connectors, Scheduled Tasks, Computer Use, RBAC
Connectors = MCP bridges to your external services. Scheduled Tasks = fixed-time automation (watch, reports, consolidation). Computer Use = drive a GUI without an API; RBAC = who can do what in enterprise.
Write a task brief Cowork can execute
A Cowork brief states an outcome, its source, and its destination, the way you would brief a colleague; it does not need to list steps. Official Dispatch example: describe what you want done in one sentence naming the input and the output, and let the agent plan the steps. Name which workspace, a Code workspace or a specific Cowork project, the task belongs in, or the agent lists what is available and picks one itself. A real brief also states the boundary, what to touch and what to leave alone, and what done looks like, concretely enough to check. A project's description field is read by Dispatch when routing future tasks into it, so keeping it accurate shortens every brief that follows.
Read the plan before it runs
Cowork's first task flow ends on reviewing Claude's approach before letting it run; a wrong assumption caught there costs nothing, caught after execution it can mean undoing writes or an action that cannot be undone. Manually approve pauses for every action and lets you allow or deny it; switch to it for sensitive files or accounts, a new tool or site, or any mistake that would be hard to undo. Automatically approve has Claude screen each action for safety and block what it judges unsafe, looking for a safer approach or asking directly; skip all approvals checks nothing at all. Claude always asks before permanently deleting files, in every approval mode, with no exception. Reading the plan or prompt is a check against two failures, scope creep and silent escalation; you remain responsible for everything you approve.
Approve, edit or reject a single step
Cowork has three permission modes: Manual (Allow or Deny each action), Auto (Claude self-screens for safety, does not ask every time), Skip (no checks at all). Deletion is always confirmed, in every mode: Cowork asks before permanently deleting any file regardless of your permission setting. The plan review before Claude starts is your main edit point; a dedicated per step edit control beyond Allow or Deny is not documented, check the live UI. You can stop Claude at any point once a task is running, if it looks like it is heading the wrong way.
File and folder jobs Cowork does well
Cowork's documented strengths: documents from scattered notes, real Excel spreadsheets with working formulas, slide decks from rough material, folder organization at scale, and research synthesis. Sub agent coordination splits a big file or folder job into parallel workstreams instead of working through everything one item at a time. Spreadsheets and presentations Cowork builds can be reopened and refined with the Claude for Excel and Claude for PowerPoint add ins. Vague instructions and unstated template expectations are the usual cause of a disappointing first task, not a limit of Cowork itself.
Cowork: acting on your files
Cowork is the desktop file agent, not the browser chat. It reads and edits local files you explicitly share with it. Actions are previewed before being applied. Best for writing, editing, summarizing, and organizing documents.
Rebuild a report or a spreadsheet with Cowork
Cowork's rebuild outputs are Excel files with real formulas, PowerPoint decks, and formatted documents, not flat CSVs or plain text you still have to fix. Give it the exact structure you want (tabs, fields, formula based summaries) and a template to copy if one exists, rather than a vague rebuild request. Cross app data sharing means content can flow between Cowork and connected Excel or PowerPoint add ins without a separate prompt each time: know what else is connected. Click into generated formulas and read them; a plausible looking number in a cell is not proof the formula behind it is correct.
Cowork: planning multi-step tasks
Cowork shows you its plan before acting. Each step is a single discrete action in an agentic sequence. Confirmation gates pause execution before irreversible changes. A failed step surfaces an error rather than being skipped silently.
Inbox triage without sending anything
Prompt injection needs two conditions together: Claude reads untrusted content (like an email) and Claude can take a compromising action; removing write access breaks the chain. Read tools (reading your inbox) and write tools (sending, deleting, creating) are documented as separate risk tiers; write tools carry the real risk. Gmail's connector defaults to read only scopes; even with drafting enabled, sending stays off and you send every email yourself through Gmail. The safe first workflow is read plus draft only, never send: sort into buckets, draft only what clearly needs a reply, review everything yourself before it goes out.
Connectors: Gmail, Drive, Calendar
Connector: an authorized link between Claude and an external service. OAuth grants access without sharing your password. Connectors are read-on-demand, not background surveillance. Revoke access instantly from Claude.ai Settings.
Scheduled Tasks: work that happens without you
Scheduled tasks run remotely as independent Cowork sessions: they fire on their cadence even when your computer is asleep or Claude Desktop is closed. Cadence options are hourly, daily, weekly, on weekdays, or manually; setup is either Create with Claude (guided) or Set up manually (name, prompt, approval mode, frequency, optional model, optional folder). A scheduled task keeps using the approval mode (Manual, Auto, or Skip) chosen at setup on every unattended run. Nothing is scheduled until you explicitly click Schedule to confirm it.
Computer Use, done safely
Computer Use lets Claude control a real computer as an agent. Prompt injection is the main attack vector: hidden instructions in external content. Always run Computer Use inside a sandbox (Docker, VM, or cloud desktop). Access is via the API using the computer, text_editor, and bash tools.
What each connector actually reads and writes
A connector's read and write capabilities are set per service: never assume one connector's abilities from another that looks similar. Claude only reaches what your own account can already reach in the source system: restricting a connector in Claude never grants more access than the source system allows. Gmail through the Google Workspace connector is read and draft only, it cannot send; the Microsoft 365 connector for Outlook can send mail directly and manage the mailbox. Google Drive extracts text content only: images embedded inside a document are not read.
Computer Use: when the mouse is the only option
Claude tries connectors first, then browser navigation, then screen control (Computer Use), in that fixed priority order. Computer Use is a fallback for software with no API: legacy, local, proprietary, or desktop-only tools, not a shortcut around a slower integration you already have. A direct connector call (for example Slack) finishes in seconds; the same read done through screen clicks is slower and more error-prone. Computer Use needs an awake computer and an open, up to date Claude Desktop app, and is a Pro/Max research preview as of this writing.
Cowork everywhere: web, mobile, remote
Cowork expanded from desktop-only to web and mobile (iOS, Android) on July 7, 2026, in beta, starting with Max plan subscribers, rolling out over several weeks. Remote sessions run on Anthropic's servers and save to your Claude account, so scheduled tasks can run with no device online, and a task can start on one device and be picked up on another. Chat and Cowork share one unified home on web and desktop, with projects and artifacts living together across both. Over 90% of Cowork usage is not software development, and doubled usage limits run as a promotion through August 5, 2026.
Roles and access control in a Cowork workspace
On Team plans, Cowork access is one organization-wide switch: on or off for everyone, no per-team control. On Enterprise plans, custom roles assigned to groups can grant or restrict Cowork, specific connectors, and models per team. A role with Identity & Access set to Can manage can edit its own role definition: reserve that permission to trusted admins, since it lets a role expand its own access. A member's permissions from multiple groups add up (the union of all grants); the organization-level toggle still overrides everything as a ceiling, and role changes take up to fifteen minutes to apply, checked with View effective role.
Pick up a desktop job from your phone
Dispatch lets you start a task from the Claude mobile app that actually runs on your desktop computer, then check results from either device. For this to work your computer must be running Claude Desktop, awake and online: your phone starts and monitors the task, it does not do the work. A child task can be Running, Awaiting input, Awaiting answer, Completed, Error or Archived, and a stalled task is usually just waiting on you. An approval request sent to your phone auto-denies after ten minutes, and the task keeps going without that one action rather than stopping entirely.
Long-running and remote Cowork sessions
A Cowork session can be local (agent loop on your device, code runs in a VM on that device) or remote/cloud (agent loop and code both run in a temporary sandbox on Anthropic's infrastructure). Only a remote session keeps working after you close your laptop, or lets a scheduled task run with no device online. A remote session that needs your local files or browser cannot reach them if the desktop app is offline, even though the remote sandbox itself keeps running. A stalled long-running task is usually Awaiting input or Awaiting answer, or it hit an unanswered permission request that auto-denies after ten minutes and moves on without that action.
The audit trail: what Cowork logged and what it changed
The durable record of what Cowork did lives in OpenTelemetry (OTel) export and, for mobile and web, the Compliance API, not in the chat transcript itself. OTel settings are read at session start only, so turning on a collector does not retroactively instrument a session that is already running. A tool_result event records whether an action was accepted or rejected and whether that decision came from configuration, a hook, or a person, the closest thing to who changed a file. By default only metadata is exported: the actual prompt text, response text, and tool arguments are captured only if an admin turns on content capture, and a purely local desktop session leaves no organization-visible trail at all.
When to hand the job to Claude Code instead
Cowork and Claude Code run the same underlying agent engine, but Anthropic built and documents them for different jobs: knowledge work beyond coding for Cowork, codebases and git workflows for Code. Dispatch's own routing rule is the official signal: coding work (fix a bug, open a pull request, run tests) goes to a Code session, knowledge work (research, write a document, organize files) goes to a Cowork session. Cowork's sandbox isolates where code runs, not what Claude reads or does, so isolation is not a substitute for choosing the right surface for the job. Cowork does not read your Claude Code CLI configuration folder; skills and plugins for Cowork are enabled separately and synced at session start.
See sept-tools.com (industry)
See totemsauvage.com (art gallery)
InstallClaw