SentinelOne announced an integration with Anthropic’s Claude Cowork that will extend SentinelOne’s AI Security coverage to one of the most critical and popular agentic work applications on the market. The integration will build on SentinelOne’s growing AI security portfolio and strategy, recently unveiled at OneCon 2026, and furthers the company’s commitment to defend the surfaces AI runs on.
As employees direct AI agents across more of their daily work, the places those agents operate become part of an expanding AI attack surface. While a lot of that AI work happens on the endpoint, in cloud workloads, and across enterprise apps, in the case of AI tools like Claude Cowork, the majority of that agentic activity happens in ways that security software on the device often cannot see. The integration between Claude Cowork and SentinelOne’s Singularity™ Platform is designed to shine a light into that potential blindspot, complementing SentinelOne’s signature endpoint detection and response (EDR) and cloud workload security (CWS) offerings and recently unveiled Singularity Agentic Detection and Response (ADR).
SentinelOne Inside the Claude Cowork VM
Claude Cowork does its work inside a virtual machine (VM) on the employee’s device. The integration will place SentinelOne’s runtime security directly inside that VM. Security teams can then see what an AI agent does on the system, receive alerts on suspicious behavior, and autonomously stop attacks using the same runtime detection and response SentinelOne already runs across endpoints.
What the Integration Delivers
- Visibility inside the Cowork VM. A SentinelOne agent will run inside the VM, so security teams can see what Cowork does there instead of working around a blind spot.
- Behavioral detection and agentic tracing. The same Behavioral AI detection engine SentinelOne runs on endpoints will apply to activity in the VM, so analysts are alerted to anomalous behavior and agent drift.
- Coverage across operating systems. The integration will support Claude Cowork across macOS and Windows devices.
- Customer-controlled rollout. IT teams will enable the integration through device management, so customers decide when and where it turns on.
“Our integration strategy across the AI ecosystem is simple: secure AI work where it happens. Claude Cowork is one of the most popular AI applications on the market, used by millions of workers around the world, so it is exactly where defenders need to be,” said Melissa K. Smith, SVP, Global Strategic Partnerships and Initiatives, at SentinelOne. “With this integration, security teams can say yes to the way their people want to work with AI, with the confidence that SentinelOne is covering that work.”
