What happened
On Nov 2, 2026, Palo Alto Networks announced a new Cortex XDR integration with Claude Cowork (Claude Enterprise): a lightweight XDR sensor is placed inside the local VM where Claude Cowork runs to give runtime visibility into agent actions (files, commands, executed systems) and detect malicious behavior in real time with Unit 42 threat intel. It is in private preview, with availability in the coming months.
Why it matters
Claude Cowork's local VM is a security boundary that also blocks EDR sensors, creating an agent blind spot on the desktop; this integration addresses the gap and fits Palo Alto's broader 'every agent on the endpoint' strategy alongside Cortex Agentic Endpoint Security and Prisma AIRS Unified Data Protection for Claude.
Applicability
Palo Alto customers deploying Claude Cowork to desktops should watch this preview; security teams worried about desktop agents escaping endpoint controls should evaluate their isolation approach now to plan coverage.