Loading story…
Anthropic updated Claude Cowork and Claude Code to let their computer-use capability operate applications in background windows through the Claude Desktop app, allowing users to continue working in the foreground. The feature is available on macOS and Windows, although background execution is currently restricted to macOS 15 or later and is disabled by default.
Claude preferentially uses native service connectors and browser-based workflows before resorting to direct screen interaction. Anthropic cautions that screen-level control does not provide the isolation of sandboxed code execution or permissioned file access, increasing exposure to malicious prompt injection and social-engineering attacks; organizations should treat the capability as privileged automation and enforce scoped access, monitoring, and deployment governance.
Track how attackers are adapting to this technology.
3 events from the most recent confirmed update back to the earliest known activity.
Anthropic introduced the underlying computer-use capability through its developer API in late 2023.
Anthropic added background execution for computer use, allowing Claude to click, type, open applications, and complete desktop tasks in background windows while users continue foreground work. The feature is delivered through Claude Desktop for macOS and Windows, is disabled by default, and background execution is currently limited to Macs running macOS 15 or later.
Anthropic later made computer use available to Claude Cowork and Claude Code users with Pro and Max subscriptions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic has upgraded its Claude in Chrome extension into a full **Claude Cowork** client, adding persistent sessions that carry browser conversations into a user’s Claude history and exposing saved skills and connectors directly in the Chrome sidebar. The company said the extension is designed to let users continue work across desktop, mobile, and browser environments, including browser-based internal dashboards, legacy systems, and vendor portals that do not natively integrate with Claude. Anthropic said **prompt injection** remains the primary security risk for browser-based AI agents and tied the rollout to its published research on browser-use prompt-injection defenses. The company said it has extended Claude auto-mode protections to the extension, while still requiring explicit user approval for sensitive actions such as purchases or sharing personal data. The feature is available now for **Max** and **Team** subscribers, will reach **Pro** users in coming weeks, and is disabled by default for **Enterprise** deployments unless administrators enable it and can optionally limit use to specific domains.
Aug 12, 2026
Anthropic released an update that lets **Claude** interact with third-party workplace applications *inside* the chat interface using the open **Model Context Protocol (MCP)**, reducing the need to switch between separate app tabs. The capability supports interactive embedded experiences (e.g., project boards, dashboards, design canvases, messaging) so users can view and edit content from services such as **Slack, Asana, Box, Canva, Figma, Hex, and monday.com** directly within Claude, including workflows like drafting incident communications or updating task timelines. The implementation is powered by an MCP extension described as **MCP Apps**, which allows an MCP server to provide an interactive UI that can render and accept user actions within an AI product. ZDNET characterized the move as part of Anthropic’s broader push to make Claude a primary work interface, building on earlier “connector” approaches that primarily moved data via prompts; the new approach enables more direct, app-native style interaction within the Claude conversation. A separate ZDNET piece offering general “IT playbook” guidance for the AI era does not provide substantive details about this specific Claude/MCP integration update.
Jun 29, 2026
Researchers disclosed **SharedRoot**, a sandbox escape in Anthropic's Claude Cowork for macOS that could let a locally running AI agent break out of its Linux virtual machine and read or modify files on the host Mac. According to the report, the issue affected roughly **500,000** macOS users running local Cowork sessions before mitigations, and the attack chain relied on `CVE-2026-46331` ("pedit COW") to escalate privileges inside the guest until the agent gained guest-root access. The breakout was possible because the host filesystem was reportedly mounted **read-write** into the guest VM, allowing guest-root to pivot into host files with the permissions of the logged-in desktop user. The underlying mechanics align with Linux capability and namespace behavior that can expand what privileged processes inside a guest can access, while Apple virtualization features enabled the local VM model used by Cowork. Anthropic reportedly classified the finding as informative rather than issuing a direct patch, and newer Cowork releases now default to **cloud execution**, leaving users who still run local sessions exposed unless stronger architectural isolation is added.
Jul 23, 2026