Anthropic’s Claude Convergence Makes Shadow AI Harder to Contain

Note: This is Gartner’s first take on the announcement. Gartner will make updates as the Claude chat and Cowork unification evolves and more information becomes available. This update follows fact review from Anthropic.

Making Cowork available through ordinary Claude conversations may increase its overall use. Anthropic has not indicated how visible Claude’s routing decisions will be to users or administrators, making consumption harder to predict. Increased use could raise aggregate costs and expose more routine requests to autonomous execution. On the other hand, Claude may reduce unnecessary token consumption by reserving Cowork’s multistep execution for requests that require it, rather than requiring users to make that decision themselves.

Anthropic states that multistep tasks consume more usage than quick questions because each step uses tokens. Organizations should use Anthropic’s telemetry to establish whether improved routing reduces consumption, or whether broader use offsets those savings.

Application leaders should verify the cost and conduct of routed tasks, rather than assume routine requests will always follow an efficient or acceptable execution path.

The autonomous nature of coworking agents can create operational and reputational risks, because Claude decides how to achieve the requested outcome. When Cowork entered preview, limited enterprise management and monitoring made controlled deployment difficult. 

Anthropic now provides organizationwide disablement, group and role-based access for Enterprise plans, separate controls for cloud execution and automatic approval, connector and plug-in governance, and telemetry covering usage, cost and agent activity. Cowork activity is also captured through Anthropic’s Compliance API.

These changes make controlled enterprise deployment more achievable, but risks remain:

• Prompt injection can influence agent behavior, despite Anthropic’s use of model training, classifiers and sandboxing to reduce its likelihood and contain its effects.

• Approved integrations can expose Cowork to more authority than an individual task requires, even when access remains within the user’s existing permissions.

• Cowork can reproduce or move sensitive information through permitted outputs and actions. Anthropic’s approval and tool controls reduce this risk but do not remove the need to monitor sensitive data movement.

• A connected system may grant the user more authority than an individual task requires. Cowork can act within those permissions, exposing sensitive data or systems of record to unintended action even though Anthropic’s access controls are operating as designed.

Anthropic’s native controls can restrict prompts, tool calls, network access and user-approved actions, while its telemetry provides visibility into Cowork execution. These capabilities can work with an organization’s DLP and other security controls, but are not a replacement for them. Organizations still need specialized controls to constrain Cowork’s reach. When Cowork takes control of a computer, it can navigate browsers, interact with applications and move sensitive information in ways that conventional text-based monitoring may not detect. Organizations need controls designed specifically to monitor and restrict these actions.

Account for this when assessing Cowork use cases and partner with cybersecurity to implement specialized controls. Treat Anthropic’s telemetry as one source of execution evidence and integrate it with other security controls to constrain agent access, monitor runtime behavior, correlate activity across security systems and detect sensitive data movement.

Disable or restrict Cowork where its use has not been approved.

• Use the organizationwide setting, groups and custom roles to prevent ungoverned access.

• When restricting access or preparing to enable Cowork, review cloud execution, automatic approval, browser access and write-capable connectors separately, because these capabilities have their own controls.

• Use endpoint protection and specialized AI security controls to enforce security guardrails and monitor coworking activity.

Monitor enterprise rollout.

• Enterprise administrators must complete their assessment in the coming weeks.

• Prepare communications for existing Cowork users who will encounter the changed interface and for Claude users who may expect access to capabilities announced publicly, but are restricted by organizational policy.

Establish governance and implement specialized AI security controls before enabling Cowork.

• Approve specific users and use cases, and then restrict Claude to the applications, data and actions required for them.

• Require human approval for consequential actions and protect systems of record from unintended changes.

• Update acceptable use policies to make users accountable for delegated work and approved actions, while defining the responsibilities of application owners, administrators and control functions.

• Use Anthropic’s telemetry to monitor consumption.