Claude Cowork: a practitioner’s field guide.

What Cowork actually is

Cowork is Anthropic's positioning of "Claude Code power for knowledge work": an agent that reads and writes your files, calls your work apps via connectors, and runs work autonomously while you do something else. It launched in research preview at the end of January 2026 and went generally available across macOS and Windows on April 9, 2026, with concurrent enterprise controls. Then it moved fast:

• July 7, 2026: Cowork came to the web and mobile apps, and sessions started running remotely in the cloud (beta), so work continues when you close your laptop and syncs across devices.
• September 16, 2026: Anthropic merged Cowork and chat into one Claude. There's no Cowork mode to switch into any more. You describe what you need, and Claude decides whether to answer a quick question or take on the bigger job and hand back finished, editable files. Your Cowork tasks, projects, connectors, skills, and files carry over. The merge is rolling out to Pro and Max first (web, desktop, and mobile), with more plans to follow; Enterprise admins get at least 30 days' notice before anything changes for their org.

So "Cowork" is now less a place and more a set of capabilities. Anthropic still uses the name in its docs and admin settings, and I use it here as shorthand for "Claude doing work, not just answering." You're still talking to Claude; you've just given Claude permission to do more than answer.

The mental model that works:

• The consumer Claude app is a smart conversation partner that lives in a sandbox.
• Claude Code is a coding agent in your terminal that operates on a repo.
• Claude Cowork is a knowledge-work agent on your desktop that operates on your files, calendar, email, docs, and (with permission) the screen.

Where Cowork is genuinely different from "ChatGPT but with file access" is the primitive set: Connectors, Plugins, Projects, Scheduled Tasks, cloud sessions, and Computer Use. None of those primitives are unique to Cowork in isolation. But the way they compose is.

Who Cowork is for

Three audiences, in order of fit:

1. Knowledge workers with recurring multi-source synthesis tasks: analysts, ops folks, researchers, anyone whose week includes "read the same five sources every Monday and produce a brief." Cowork's scheduled tasks are the killer feature here.
2. Teams who want a shared agentic surface, like sales ops, RevOps, and legal ops. The connector ecosystem (Apollo, Clay, Outreach, DocuSign, FactSet, etc.) is built for these workflows.
3. Engineering teams as a complement to Claude Code, for when the work isn't "edit a repo" but "look at this dashboard, summarize the issue, file a ticket, then write the fix in Code."

Cowork is not a great fit if your work is: pure conversation (use the consumer app), pure code (use Claude Code), or needs your local files while you're away from your desk (mobile and web can start and follow tasks, but anything touching your computer still needs Claude Desktop open and connected).

Getting started

Where you can use it

Cowork is on paid plans only (Pro, Max, Team, Enterprise). Free does not get it. As of September 2026 it runs in:

• Claude Desktop (macOS or Windows, from claude.com/download): all paid plans. This is the only place Claude can reach your local files, the built-in browser, and computer use.
• The web (claude.ai) and the iOS and Android apps: Pro, Max, and Team; Enterprise where an admin has enabled it.
• The Claude in Chrome side panel: Max and Team, rolling out to Pro; Enterprise where enabled.

Getting started is lighter than it was in May. If you have the merged experience, there's no mode to switch into: just ask for the bigger job in a normal conversation. If you're still on the older layout (Team, and Enterprise until your admin opts in), you'll see Cowork as its own entry in the desktop sidebar. Either way, on desktop, grant a working folder and optionally connect your first Connector. Cowork wants you to start with one task, not configure twenty things upfront.

Permission modes

New since May, and the first setting I'd look at. Three modes decide when Claude stops to ask you:

• Manual: asks before each action. Slow, but the right place to start.
• Auto: Claude reviews its own actions for safety and blocks unsafe ones automatically. The safety checking uses more of your usage.
• Skip: no automatic checks at all. Highest risk; I don't use it for anything touching email, contracts, or money.

The primitives, in order of importance

The features that matter, ranked by how often you'll touch them:

1. Projects: workspaces. The thing you organize work around.
2. Connectors: Cowork's link to your other apps.
3. Plugins: bundles of conventions, slash commands, and MCP servers per use case.
4. Scheduled tasks and cloud sessions: autonomy. The thing that makes Cowork qualitatively different from chatting.
5. Computer Use: the escape hatch when nothing else covers what you need.

Models: what Cowork runs on

Cowork uses the same model picker as the rest of Claude, and the lineup changed almost completely over the summer. For agentic work this matters more than it does in chat, because the model's judgment is what stands between your instruction and your inbox.

Why the new models matter for an agent

• Opus 5.5 (September 22) performs at the level of Fable 5.1 on most work, per Anthropic, and produces output more than 30% faster than Opus 5. The part I'm most excited about for Cowork is safety behaviour: Anthropic reports it tried to circumvent boundaries about 85% less often than Opus 5 and is much less likely than recent models to take hard-to-reverse actions. That's exactly the failure mode this guide keeps warning about. Anthropic also raised five-hour usage limits on Pro, Max, Team, and seat-based Enterprise alongside the launch.
• Fable 5.1 (September 1) brings stronger long-running agentic work, multi-step research, and document, spreadsheet, and slide work, which is most of what people use Cowork for. Testers describe it as more comfortable with long, unattended work than Fable 5. For high-risk cybersecurity or biology requests it hands the request to an Opus model automatically.
• Sonnet 5 (June 30) is Anthropic's most agentic Sonnet yet, with its biggest gains over Sonnet 4.6 in coding and tool-using tasks. It makes a very capable, cheaper engine for scheduled chores.

Projects

A Cowork Project is a dedicated workspace tied to a folder on disk. Each Project carries its own:

• Working folder (where Cowork reads and writes files by default).
• Connector permissions (which Connectors are enabled, scoped to this Project).
• Plugin set (which Plugins are loaded, again per-Project).
• Scheduled tasks bound to the Project.
• Conversation history.

The mental shift from the consumer Claude app's "Projects": consumer Projects are conversation contexts; Cowork Projects are workspaces with state on disk. They aren't the same thing, even though Anthropic uses the same word for both. Your Cowork projects carry over into the merged experience unchanged.

Project hygiene

• One Project per workflow, not per topic. "Weekly competitive brief" is a Project. "Marketing" is a category that contains many Projects.
• Keep the folder narrow. Cowork reads everything in the folder. If you point it at ~/Documents you'll get worse, slower behavior than if you point it at ~/Documents/work/competitive-brief.
• Treat the Project folder as Cowork-managed. Files Cowork creates have semantic meaning to it. Don't restructure them by hand without a reason.

Connectors

Connectors are Cowork's official integrations into other apps. As of September 2026, the roster includes:

• Google Workspace: Gmail, Calendar, Drive, Docs.
• Microsoft 365: since July it goes beyond search, with write tools for Outlook email and calendar and for files in OneDrive and SharePoint. Teams remains read-only.
• Communications: Slack, Zoom.
• CRM: Salesforce (beta since September 15), shipping with 37 pre-built sales skills for opportunity and pipeline work.
• Documents & legal: DocuSign, LegalZoom, Harvey.
• Sales & outreach: Apollo, Clay, Outreach.
• Research & data: Similarweb, MSCI, FactSet.
• Web: WordPress.
• Custom: any MCP server (see Plugins below). Local MCP servers are desktop-only.

The list is growing. By the time you read this, expect more. On Team and Enterprise, admins now control connector access per custom role and can require approval for write-capable connector tools.

The permission model

Connectors auth via OAuth through Anthropic's brokered flow. When you enable Gmail, you grant Anthropic an OAuth token scoped to your Gmail account; Cowork then uses that token (with your live user identity) to call Gmail on your behalf. Two implications worth understanding:

1. Connector tokens are stored per-account. Connecting Gmail in your personal Pro account does not connect it for your Team account, even if both accounts log into the same email.
2. Connector access is mediated, not granted to the model directly. Cowork sends Claude an abstract description of what's available; Claude proposes actions; Cowork executes them via the connector with your identity. The model never holds your token.

Scope-of-trust framing

The most important question to ask before enabling a Connector: what is the worst-case if Cowork acts wrongly within this Connector's scope?

• Read-only Connectors (Calendar, Drive, FactSet) are generally low risk. Worst case: Cowork reads something you didn't intend it to. That's awkward but reversible.
• Read/write Connectors with revocable actions (Gmail drafts, Calendar events) are medium risk. Worst case: Cowork sends an email, files an event, makes a change you have to undo. Annoying but not catastrophic.
• Read/write Connectors with hard-to-reverse actions (DocuSign signatures, Outreach send actions, anything that touches an external party) are high risk. Worst case: Cowork commits you to something. Treat these like production database writes. Gate behind explicit confirmation, never automate via unattended scheduled tasks.

Plugins

Plugins are bundles. The mental model: a Plugin is a "work theme" that ships custom slash commands, Skills, Connectors, and MCP servers as a single install. Where a Connector is one tool, a Plugin is a coordinated set of tools plus the conventions for how to use them.

Examples (real or expected, depending on when you read this):

• Sales Ops Plugin: bundles Apollo + Outreach + Clay connectors, custom /find-prospects, /draft-outreach slash commands, and Skills for sales-style email drafting.
• Legal Ops Plugin: bundles DocuSign + Harvey + LegalZoom, with redaction and contract-review Skills.
• Engineering Triage Plugin: bundles GitHub MCP, your incident-management tool, and Skills for incident summarization.

Plugins can be installed from a public marketplace (Anthropic's curated list) or from private marketplaces on Team and Enterprise plans. Private marketplaces let an admin author and distribute org-specific Plugins, and mark each one auto-installed, available, required, or hidden, with overrides per group. That's the right primitive for "every analyst on our team should have these connectors and these conventions." Since August, Enterprise also has skill and plugin security scanning (beta), which automatically checks third-party skills and plugins for malicious content.

MCP support

Cowork is a first-class MCP host: any MCP server can be added as a Connector via the Plugins surface. If a tool you use exposes an MCP server (or you've built one for your own internal tools), Cowork can use it. This is the extension lever for everything Anthropic doesn't ship a Connector for.

Practical advice: start with first-party Connectors before MCP. Built-in Connectors are integrated, audited, and have proper UI for permissions. Custom MCP servers are powerful but ship the burden of operating them onto you.

Scheduled tasks, cloud sessions, and Dispatch

This is the part of Cowork that's qualitatively different from "ChatGPT plus connectors." It also changed the most since May. Three pieces, layered:

Cloud sessions

Since July 7, Cowork sessions run remotely in the cloud (beta). Work keeps going when you close your laptop, and the same task is visible from web, desktop, and your phone. The catch: anything that needs your local files or apps only works while Claude Desktop is open and connected. Everything else (Connectors, web research, building a spreadsheet or deck) happens in the cloud.

Scheduled tasks

Scheduled tasks shipped in February 2026 as desktop-bound: if your laptop was closed, the task waited. That's no longer true. Scheduled tasks now run in the cloud on their cadence even when your computer is asleep or the desktop app is closed. The exception is a task that needs local files or apps; those still only run locally. Available on all paid plans, on desktop, web, and mobile.

Two ways to create one. The easy way is to just ask in a conversation ("every Monday morning, summarize my inbox"). The deliberate way: Scheduled in the sidebar → New task, then either Create with Claude (it asks clarifying questions) or Set up manually, where you set the name, prompt, approval mode, frequency (hourly, daily, weekdays, weekly, or manual), and optionally the model and folder. A prompt like this works well:

each weekday at 8am, read my unread Gmail
since 6pm yesterday, summarize anything important,
save the brief as a Google Doc in my "Inbox briefs"
folder, and list anything that needs my response
in <5 bullet points>.

Because it only touches Connectors, that one runs in the cloud whether my laptop is open or not. Had I told it to write to ~/work/inbox-brief.md, it would become a local task and depend on the desktop app. The same Scheduled view is where you edit instructions, pause and resume, delete, or run a task on demand.

Dispatch

Dispatch was the bridge that let you hand a task from your phone to Cowork on your desktop. In the merged experience it isn't available to new users; if you already use it, you can keep using it for now. For most people it's been overtaken: you can start a task from the mobile app directly and it runs in the cloud, and it only needs your desktop if it touches local files or apps.

Computer Use

Computer Use is Cowork's escape hatch for things no Connector covers. Claude controls your screen (clicking, typing, opening apps, navigating windows) the same way you would. As of September 2026 it's in beta, for Pro and Max plans only, and it needs Claude Desktop on macOS or Windows. For web-only tasks, the built-in browser (or Claude in Chrome) is usually the better, narrower tool.

How it works

1. You enable Computer Use in Settings (per-Project, gated by an explicit user confirmation).
2. Claude takes screenshots of your screen, identifies UI elements, and proposes actions: click here, type this, press that key.
3. Each action is executed via OS-level UI automation (Apple Accessibility on Mac, UI Automation on Windows).
4. You can watch in real time, intervene if needed, or task-switch and let it run.

The permission model

• Per-app permission: Claude asks before opening or interacting with each application the first time.
• Per-folder permission: file system access still goes through the regular Cowork "always allow this folder?" gate.
• Deletion is gated separately: Cowork prompts for explicit confirmation before any file deletion, even within an allowed folder. This is one of the strongest safeguards.
• Shell commands run in an isolated VM, not on your machine directly. Code Claude wants to execute is sandboxed.

When Computer Use is the right tool

• Apps without Connectors that you must use (corporate intranets, old web apps, internal SaaS).
• Multi-step UI flows with no API equivalent.
• One-off tasks where wiring a Connector isn't worth it.

When it isn't

• Any task where a Connector exists. The Connector is auditable, the Computer Use isn't.
• Anything involving credentials Claude didn't see you type.
• Anything that ought to be reversible but isn't (transferring funds, sending DMs, deleting things).
• Anything the human would do by clicking through a security warning. Claude won't, but the fact you're considering it means: don't.

Enterprise controls

Cowork's GA on April 9, 2026 brought a meaningful set of enterprise controls, and the summer added more. The current picture:

Org-level switches

• Turn Cowork on or off for the whole organization in Organization settings.
• Control cloud sessions separately from desktop Cowork, and the built-in browser and Claude in Chrome separately again.
• Configure network egress for code execution, disable web search, manage MCP connector authorization org-wide, and set a default model (plus, since July, which models and effort levels each role can use).
• The chat/Cowork merge and the new Claude Design, Slides, and Docs betas don't just appear: admins get at least 30 days' notice before the merge changes anything, and choose when to turn the betas on.

Role-based access (RBAC)

• Admins create groups in the admin console (or via SCIM sync from your IdP).
• Each group is assigned a custom role defining which Cowork capabilities its members can use.
• Capabilities can be enabled or disabled per-group: Cowork itself, specific Connectors, write-capable connector tools, the "Automatically approve" permission mode, Plugins from a private marketplace, etc. When roles overlap, the most restrictive layer wins.
• Practical pattern: Sales group gets the Sales Ops Plugin and CRM Connectors but not Computer Use; Engineering group gets MCP and Computer Use but not the legal Connectors.

Group spend limits

• Per-group caps on Cowork usage.
• Soft caps trigger warnings; hard caps gate access.
• Useful for departmental cost attribution and for keeping a stress-test deployment from blowing your monthly bill.

Usage analytics

• Per-user, per-group, per-Connector usage breakdowns.
• Surfaces who's using what, which Connectors are getting traction, and who needs onboarding (low usage often = stuck setup).
• New on Enterprise since September 10: Smart reports (beta), which analyze your team's Claude usage, costs, friction points, and patterns worth packaging as shared skills.

OpenTelemetry

Cowork emits OpenTelemetry events for everything:

• Tool and connector calls (which Connector, what it did).
• Files read and modified.
• Skills invoked (and which Plugin authored them).
• Whether each AI-initiated action was approved manually or automatically.
• Computer Use actions, with target application and action type.

OTel events are compatible with standard SIEM pipelines, including Splunk, Cribl, and any OpenTelemetry-conformant collector. A shared user-account identifier correlates OTel events with records from Anthropic's Compliance API, so you can build a single audit picture across SIEM and the platform's own audit log.

OpenTelemetry export is on Team and Enterprise plans. The Compliance API now also covers remote (cloud) session data.

SCIM and SSO

Standard SAML / OIDC SSO and SCIM provisioning. Standard fare for Enterprise, but worth confirming because some teams' first attempt is to spin up Cowork without going through their IdP, then migrate later. Migrating later is harder than starting in the right place.

Limits and what they mean

Plan availability

• Free: no Cowork.
• Pro / Max: full Cowork including Connectors, Plugins, scheduled tasks, cloud sessions, and Computer Use (beta; Pro and Max only). First in line for the merged chat + Cowork experience.
• Team: Cowork on desktop, web, and mobile with shared admin controls, group spend limits, OpenTelemetry, private Plugin marketplace.
• Enterprise: all of Team plus RBAC, SCIM, custom roles, advanced compliance integration. Web and mobile Cowork only where an admin enables them.

Quota model

• Everything you do with Claude counts toward your plan's usage limits: the same 5-hour rolling window and weekly limit your chats use, shared with Claude Code. Scheduled and cloud tasks count too.
• Longer agentic tasks use much more than a quick question, and the Auto permission mode uses more again, because of its safety checks.
• Model choice is the biggest lever. Fable 5.1 burns budget fastest (and is capped at 50% of weekly limits where it's included); Sonnet 5 stretches it furthest. Paid plans can buy usage credits to keep going.
• Connector calls are also subject to the connected service's own rate limits.

What Cowork can't do

• Replace Claude Code for code. Cowork can read and reason about code, but Claude Code's repo-aware loop, hooks, and subagent model are tighter for development. Use Code in Cowork for "look at this code and explain"; reach for Claude Code for "edit this codebase."
• Touch your machine when the desktop app is closed. Cloud sessions and scheduled tasks keep running, but local files, the built-in browser, and computer use all need Claude Desktop open and connected.
• Talk back in voice mode. In Cowork you get dictation, not full voice mode. Mobile Cowork is now fully interactive, but it's a typing experience.
• Be shared. There's no session sharing between users yet; a task belongs to whoever started it.
• Run unattended over long horizons. A Scheduled Task that fails at 3am still fails. Cowork retries some failures but isn't a robust workflow engine. For mission-critical scheduled work, build it in your normal infrastructure and have Cowork augment it, not own it.

Best practices

Troubleshooting playbook

The patterns to recognize. Each one has a short fix.

Closing thought

Cowork is the most ambitious agent surface Anthropic has shipped, and the one most likely to genuinely change knowledge work. It's also the one most likely to embarrass you if you treat it like a clever search engine. The defining trait isn't intelligence. It's permission. You're handing the model the keys to your filesystem, your inbox, your calendar, and (on Computer Use) your screen. The leverage is enormous; the failure modes are real.

Cowork is not a smarter Claude. It's a Claude that can do things. Treat the gap accordingly. — TWD

The good news: Anthropic has done a thoughtful job on the permission model. Per-folder gates, per-app prompts, deletion confirmation, OTel export, RBAC for orgs: the bones are right. The failure modes that remain are mostly user-side: too-broad folder grants, scheduled tasks wired to external send-actions, Computer Use enabled in haste, group roles set as "everyone gets everything because it's easier."

Build the trust slowly. Start with one Project. Read the logs. Add Connectors deliberately. Let scheduled tasks run unattended only for things you'd be willing to read about in your morning brief if they went sideways. Save Computer Use for last, when nothing else fits.

And keep an eye on the changelog at claude.com/product/cowork. Cowork is moving faster than this guide can keep up with. Since May it came to web and mobile, moved into the cloud, and merged with chat; connectors, plugins, and skills get added monthly; permission models get refined; Computer Use is still in beta. Treat this guide as the September 2026 snapshot it is, and check Anthropic's release notes for anything newer.