Claude Cowork

Incomplete, delayed and not restorable: the account export arrives by email, is not documented as covering Cowork sessions, plugins or scheduled tasks, and has no import back into Cowork. Local session files sit on disk but can only be copied by hand.

• Export your Claude data
• User identity and local data (Claude Desktop on 3P)

Local sessions keep transcripts, uploads, outputs, memory and plugins on the device, but cloud sessions, files and scheduled tasks live in the Claude account, and neither path yields a documented export that also covers connectors and credentials, so the whole agent cannot be taken out.

• Use Claude Cowork on web, desktop, and mobile
• User identity and local data (Claude Desktop on 3P)
• Export your Claude data

Cowork runs only inside the proprietary Claude Desktop app or Anthropic's cloud sandbox. Even the 3P deployment mode must download the VM workspace bundle and Claude CLI binary from downloads.claude.ai at session start.

• Claude Cowork architecture overview
• Claude Desktop on 3P overview

Identity is the Anthropic account (or a random per-device UUID in 3P mode), and nothing lets peers verify after a migration that it is the same agent.

• User identity and local data (Claude Desktop on 3P)

Cowork depends on an Anthropic account, Anthropic-hosted inference and Anthropic-served runtime components, so the provider can restrict or disable it; there is no exported agent that runs independently.

• Get started with Claude Cowork
• Claude Desktop on 3P overview

Scheduled tasks, cloud execution, memory, connectors and computer use are delivered by Anthropic's platform, and only Claude models can drive them. Skills, plugins and MCP connectors use open formats, which partly mitigates this.

• Schedule recurring tasks in Claude Cowork
• Install plugins
• Models and effort levels (Claude Desktop on 3P)

Local sessions are documented as per-session JSON files, Markdown memory and a JSONL audit log readable without Anthropic software. Cloud sessions, now the default, are stored in Anthropic's backend in an undocumented format.

• User identity and local data (Claude Desktop on 3P)
• Use Claude Cowork on web, desktop, and mobile

Anthropic publishes system prompts only for claude.ai chat and the mobile apps, not for Cowork's agent layer. Owner instructions, skills and plugins are visible, but content classifiers and auto-mode action screening act out of view.

• System prompts release notes
• Use Claude Cowork safely

Cloud sessions and files are stored on Anthropic servers, and deleted tasks remain in backend storage for up to 30 days. Consumer retention rules keep flagged content up to 2 years and safety classification scores up to 7 years, outside owner-inspectable state.

• Get started with Claude Cowork
• How long do you store my data?

Local sessions keep an on-disk record of tool invocations, permission decisions and file operations alongside the transcript, which meets the outcome for those sessions. For cloud sessions, the default, the owner sees only the in-app transcript, and export of every tool call via OpenTelemetry is limited to Team and Enterprise.

• User identity and local data (Claude Desktop on 3P)
• Monitor Claude Cowork activity with OpenTelemetry

Plugins bundle skills, subagents and hook scripts as human-readable files that the owner can inspect. The Cowork orchestration, sandbox and desktop app are closed source.

• Install plugins
• Claude Cowork overview

Anthropic has committed that Claude will remain ad-free, with no sponsored content or advertiser influence in responses, and Cowork is now part of the same Claude app. The company reserves the right to revisit this with transparency.

• Claude is a space to think
• Claude Cowork and chat are one Claude

Local sessions record tool invocations and file operations in an append-only log, but documentation does not say that every consequential action is recorded or that an action is blocked when it cannot be; cloud-session recording is undocumented.

• User identity and local data (Claude Desktop on 3P)

In local sessions each audit log entry is HMAC-chained to the previous one, so edits or deletions are detectable. No tamper evidence is documented for cloud sessions, the default.

• User identity and local data (Claude Desktop on 3P)
• Claude Cowork architecture overview

Documentation does not state whether the agent, which runs in a sandbox VM with the session working directory mounted, can alter or delete the local audit log, or how cloud-session records are protected.

• User identity and local data (Claude Desktop on 3P)

The local audit log is plain JSONL on disk and readable with ordinary tools. Cloud-session activity is reachable only in the app or, for Team/Enterprise, via the Compliance API and OpenTelemetry.

• User identity and local data (Claude Desktop on 3P)
• Use Claude Cowork on Team and Enterprise plans

Cowork coordinates subagents and a Dispatch agent internally, but documents no exchanges with other agents whose records each side could match against the other's.

• Get started with Claude Cowork
• Assign tasks from anywhere in Claude Cowork

Claude Desktop, the Cowork VM bundle and the cloud sandbox are proprietary; use of the app is governed by Anthropic's terms, and no OSI-licensed, reproducible runtime is published.

• Legal and compliance (Claude Desktop on 3P)
• Claude Cowork architecture overview

Instructions, memory files and plugins are inspectable, and 3P deployments use inspectable JSON configuration. For consumer accounts, server-side configuration, classifiers and account-synced settings cannot be verified to match what the owner sees.

• User identity and local data (Claude Desktop on 3P)
• Claude Cowork overview

Messages go out through the owner's connected accounts and connectors, and recipients cannot verify that they came from this agent under the owner's authority.

• Claude Cowork architecture overview

The local audit log is HMAC-chained with a keychain-protected key, but no verification procedure or open verifier is published, so its integrity cannot be checked independently of Anthropic's app.

• User identity and local data (Claude Desktop on 3P)

Local-session state (transcripts, memory, plugins and the audit log) sits in ordinary files that the owner can snapshot and compare with standard tools. Cloud sessions, the default, and account-synced settings are not fully exposed, so changes there cannot be verified.

• Use Claude Cowork on web, desktop, and mobile

Owners can write global "Instructions for Claude", folder and project instructions, and skills, but cannot read or rewrite Cowork's platform system prompt or safety layers.

• Claude Cowork and chat are one Claude
• Get started with Claude Cowork

Cowork memory is stored as Markdown notes that owners can review, delete individually or pause, and memory shared with chat can be viewed, edited and deleted in Settings.

• User identity and local data (Claude Desktop on 3P)
• Use Claude's chat search and memory

Owners can install, upload, edit and remove plugins containing skills, subagents and hook scripts, and can add Git repositories as marketplaces. The core agent loop and sandbox cannot be changed.

• Install plugins

Owners can add custom MCP connectors and plugins, disconnect connectors, block apps from computer use and set sandbox egress permissions. Egress permissions do not cover web tools or MCPs, and fine-grained tool policies are documented mainly as managed or admin configuration.

• Install plugins
• Let Claude use your computer in Cowork
• Use Claude Cowork safely

Only Claude models can be selected. The 3P mode changes where Claude inference is served (Bedrock, Vertex, Foundry or a Messages-API gateway), not the model family, and local open-weight models are not supported.

• Models and effort levels (Claude Desktop on 3P)
• Claude Desktop on 3P overview

Cowork requires a paid plan, computer use is limited to Pro and Max, and OpenTelemetry monitoring is limited to Team and Enterprise. All modifications are bounded by Anthropic's product surface and terms.

• Get started with Claude Cowork
• Let Claude use your computer in Cowork
• Monitor Claude Cowork activity with OpenTelemetry

Cloud sandbox traffic passes through an enforced egress allowlist, the browser asks before acting on a new site, and apps can be blocklisted. These boundaries do not cover web fetch, web search or MCP connectors, and no per-recipient controls are documented.

• Claude Cowork architecture overview
• Use the built-in browser in Claude Cowork
• Use Claude Cowork safely

A Manual mode pauses for sign-off on connector, plugin, browser and some Cowork actions, and permanent file deletion and new app access always require permission. Manual mode does not cover every action, and enforcement cannot be independently verified.

• Get started with Claude Cowork
• Use Claude Cowork safely

Owners can stop Claude at any point during a task, and scheduled tasks can be paused or deleted.

• Let Claude use your computer in Cowork
• Schedule recurring tasks in Claude Cowork

Cloud sessions process files and work on Anthropic servers, and local sessions still send content to Anthropic for inference. Consumer data is used for training when the model-improvement setting is on, which is reported to default to on.

• Use Claude Cowork safely
• Updates to Consumer Terms and Privacy Policy
• TechCrunch: opt out or share your data

Local MCP server credentials stay on the device, and connectors can be disconnected. Connector authorization tokens are held server-side and never enter the sandbox, so they are not owner-inspectable and do not travel with the agent.

• Claude Cowork architecture overview
• Install plugins

Deleted Cowork tasks leave history immediately and backend storage within 30 days, and local sessions are deleted by removing their files. Consumer retention of flagged content (2 years), safety scores (7 years) and training data (up to 5 years) goes beyond deletion.

• Get started with Claude Cowork
• How long do you store my data?
• Deleting Claude accounts