At a Glance
- Claude’s new Cowork tool can read, rename and build spreadsheets from any Mac folder you grant it access to
- The feature is locked behind a $100/month Claude Max subscription and is still in research preview
- Anthropic warns against using Cowork on sensitive data because prompt-injection attacks could let attackers hijack the AI
- Why it matters: Users gain an AI personal assistant that can automate file chores, but one wrong click could expose private documents
Anthropic has launched Cowork, a new capability for its Claude chatbot that dives into a user’s computer folder to reorganize files, rename items and spin out new documents. The tool is available only to MacOS customers who pay for the $100/month Claude Max tier, according to a company blog post on Monday.
Cowork starts by asking permission to access a specific folder. Once granted, a user can chat with Claude and request that it tidy up messy directories, apply a consistent naming scheme or read the contents and generate spreadsheets or other files. A folder stuffed with receipts, for example, can be turned into a single expense sheet in seconds.
How Cowork functions
- User selects a folder and grants Claude read/write access
- Natural-language prompts tell Claude what to do with the files
- The AI can rename, move, group or read files to create new outputs
- Connectors let Claude push data into external apps for presentations or documents
- The Claude in Chrome extension can fold browser tasks into the same workflow
Felix Rieseberg, member of the technical staff at Anthropic, told News Of Losangeles that the inspiration came from watching customers bend Claude Code to non-coding chores. “We built it for coding, but people started using it for everything-taxes, managing receipts, organizing files, random life admin,” he said. “Both developers and nondevelopers started using the agent loop to get some help from Claude on their computer.”
Anthropic insists that Claude cannot touch anything beyond the folder the user opens. Yet the company tags Cowork as a “research preview,” the equivalent of a public beta, and candidly states the AI could still trigger unintended side effects. Users should keep sensitive materials away from the feature for now.
Security concerns center on prompt-injection attacks, a technique where malicious instructions hidden on websites or inside files trick an AI into running unauthorized commands. If an attacker slips a hostile prompt into a page the browser extension visits, the AI might obey and carry out actions inside the user’s folder. Anthropic says it has built defenses, but the risk is not zero.
Cowork lands as the industry races toward so-called agentic AI-models that can act on a user’s behalf across the web. Rivals already offer similar autonomy:
- ChatGPT Agent compiles reports and books travel
- Gemini Agent handles multi-step tasks inside Google’s ecosystem
- Google’s Gemini 2.5 Computer Use model can manipulate a computer’s interface directly
Retailers are experimenting with the same concept. Last week Google and a coalition of retail partners announced an open standard that lets AIs shop across multiple stores and payment systems without human clicks.
Anthropic’s pitch is narrower but immediate: turn chaotic folders into orderly workspaces without opening a single file. The company plans to gather feedback during the preview before rolling the tool out to broader subscription tiers or Windows machines.
Key takeaways
- Cowork is live today for paying Mac users willing to beta-test
- Folder access is explicit and revocable, yet mistakes could expose private data
- The $100 paywall keeps the audience small while Anthropic refines safety guardrails
- Expect similar AI agents from every major lab within months
