Palo Alto Networks brings Cortex XDR inside Claude Cowork's virtual machine

A blind spot for endpoint security

Claude Cowork is part of Claude Enterprise and brings agentic capabilities to desktop applications. According to Palo Alto Networks, instead of answering a single prompt it plans and completes multi-step tasks by reading files, navigating applications and executing workflows.

That work runs inside a small, local virtual machine designed to act as a security boundary. The company says this isolation also prevents the EDR agent from monitoring what the AI agent does. Palo Alto Networks argues that such agents operate outside traditional endpoint controls and pose risks that many security leaders find unacceptable.

What the integration does

To close the gap, Palo Alto Networks is bringing XDR directly into the virtual machine through a lightweight sensor. According to the company, XDR will extend runtime visibility into the agent's actions, tracking accessed systems, file changes and executed commands, while detecting and preventing malicious behavior in real time.

Palo Alto Networks says the detection draws on Unit 42 threat intelligence and machine learning models trained on global telemetry, and that zero day threats are blocked by default.

To limit alert fatigue, the sensor feeds virtual machine telemetry into XDR analytics, which automatically correlates related events into unified incident stories. The Cortex platform will consolidate the agent's activity from inside the virtual machine and tie it back to the desktop in a single view. The company says this gives security teams complete context on the agent's actions alongside the rest of their endpoint data.

Part of a wider Claude security effort

Palo Alto Networks describes the move as another expansion of XDR, following the combination of XDR and Cortex Agentic Endpoint Security in XDR One, which protects both traditional system processes and AI agents. The company says the goal is to monitor every agent on the endpoint.

The company also points to related work. It is a launch participant in Anthropic's Project Glasswing, an initiative that gives a small group of organizations that build or maintain critical software early access to frontier AI capabilities for defensive cybersecurity. Earlier this year it introduced Prisma AIRS Unified Data Protection for Claude, which monitors prompts across Claude Code, Claude.ai and Claude Cowork for data leaks and prompt injections.

What it means for security teams

According to Palo Alto Networks, the combination lets security teams protect data in transit to Claude and monitor agent activity directly on the endpoint. For organizations considering desktop AI agents, the integration targets the specific problem that the agent's isolated environment hides its behavior from conventional endpoint tools.

The feature is not yet available. The company notes that unreleased features may not be delivered when expected or at all, and advises customers to base purchase decisions on generally available products. Pricing and broader availability were not stated in the announcement.