Evoke Security plans Claude Cowork integration to monitor AI agent activity

Why agent activity in the cloud is a blind spot

Evoke says employees now hand AI agents real work: reading files, calling tools, and handling sensitive data on their behalf. As that work moves to the cloud, it moves away from the endpoint, where, in the company's words, security teams have spent a decade building visibility.

The company points to a specific problem. An agent can complete a legitimate task and still take an unexpected action along the way. Without a full record of what the agent did, security teams cannot tell routine agent work from the opening move of an incident. Evoke also argues that existing security tooling was not built for how agents operate, so teams can struggle to separate normal operations from risky behavior.

What the integration is meant to do

Evoke describes the integration as part of Anthropic's expansion of security integrations for Claude Enterprise. It will extend Evoke's coverage deeper into Claude Cowork, including the virtual environment where agents operate.

According to Evoke, its platform monitors the full agent trajectory with a detection-in-depth approach. It identifies risky behavior and then either steers the agent to a safer path or blocks unauthorized actions.

Jason Rebholz, Co-Founder and CEO of Evoke Security, framed the issue around incident response. "The challenge isn't knowing an agent ran. It's understanding what that agent did and what new risks it created," he said. He added that if an agent did its work somewhere you can't see, you can't answer the first question of any incident: what happened.

Evoke's wider approach and availability

The company says the integration builds on its mission to secure the agentic workforce. That covers discovering the agents running across an organization, understanding their exposure, and detecting and responding to the agent activity that matters. Evoke also refers to its recent Rogue Agent Assessment, which it says shows how these risks surface in real environments today.

Evoke describes itself as founded by incident response veterans. According to the company, its platform lets security teams continuously inventory, threat model, and monitor AI agents, and stop risky behavior in real time.

The integration with Claude Cowork is planned for a future release. The announcement gives no date, pricing or technical details on how the integration will work. Organizations that want to learn more can visit evokesecurity.com.

What it means for security teams

For organizations adopting agents through Claude Enterprise, the announcement reflects a growing demand for tools that record and assess what agents do, not only that they ran. If the integration ships as described, Evoke says security teams would gain a fuller view of agent actions in Claude Cowork and a way to intervene when behavior turns risky. Until then, the plan remains an announcement, and the claims about detection and response come from Evoke itself.