New Cortex XDR Integration with Claude Cowork Secures Desktop AI Agents

AI agents working directly on the desktop offer new ways to automate complex tasks, yet they operate outside traditional endpoint controls and pose unacceptable risks to many security leaders. Today, we're announcing a newCortex XDR integrationwith Claude Cowork to deliver visibility and threat detection for this new agentic workspace.

Claude Cowork brings agentic capabilities directly to desktop applications as part of Claude Enterprise. Instead of responding to a single prompt, it plans and completes multi-step tasks by reading files, navigating applications and executing workflows. This work takes place inside a small, local virtual machine that is designed to act as a security boundary. However, this isolation also prevents the EDR agent from monitoring the agent’s activity. With this integration, XDR bridges that gap to deliver deep visibility and threat detection across local agentic workflows without compromising host security.

With this new integration with Claude Cowork, we’re bringing XDR directly into the virtual machine using a lightweight sensor. XDR will extend runtime visibility into the agent’s actions, tracking accessed systems, file changes and executed commands while detecting and preventing malicious behavior in real time.

Behind this protection, XDR brings together Unit 42 Threat intelligence and machine learning models trained on global telemetry to block zero day threats by default. To prevent alert fatigue, the sensor feeds virtual machine telemetry directly into XDR analytics, automatically correlating related events into unified incident stories.

The Cortex platform will consolidate the agent’s activity from inside the virtual machine and tie it back to the desktop in a single view. This gives security teams complete context into agent’s actions alongside the rest of their endpoint data.

EDR coverage across all execution environments is a baseline requirement for enterprise security teams, but it’s no longer sufficient if it doesn’t secure AI agents. Just as we brought together XDR and Cortex Agentic Endpoint Security to protect both traditional system processes and AI agents withXDR One, through this integration with Claude Cowork we are once again expanding XDR to seamlessly monitor every agent on the endpoint. The integration will be available in private preview in the coming months.

This integration builds on our broader work securing AI across the enterprise. Palo Alto Networks is a launch participant in Anthropic’sProject Glasswing, an initiative that gives a small group of organizations that build or maintain critical software early access to frontier AI capabilities for defensive cybersecurity. Earlier this year, we introducedPrisma AIRS Unified Data Protection for Claudeto monitor prompts across Claude Code, Claude.ai, and Claude Cowork for data leaks and prompt injections. Now, with Cortex XDR extending into Claude Cowork, security teams can protect data in transit to Claude and monitor agent activity directly on the endpoint.

Forward-Looking Statements

This blog contains forward-looking statements that involve risks, uncertainties and assumptions, including, without limitation, statements regarding the benefits, impact, or performance or potential benefits, impact or performance of our products and technologies or future products and technologies.Any unreleased services or features (and any services or features not generally available to customers) referenced in this or other press releases or public statements are not currently available (or are not yet generally available to customers) and may not be delivered when expected or at all. Customers who purchase Palo Alto Networks applications should make their purchase decisions based on services and features currently generally available.

By submitting this form, you agree to ourTerms of Useand acknowledge ourPrivacy Statement. Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.

By submitting this form, you agree to ourTerms of Useand acknowledge ourPrivacy Statement.

By submitting this form, I understand my personal data will be processed in accordance withPalo Alto Networks Privacy StatementandTerms of Use.

Copyright © 2026 Palo Alto Networks. All Rights Reserved