Claude Cowork Architecture: How Sessions Run and Stay Isolated

1 day ago

2 min read

⚡ TL;DR Cowork has an agent loop and code execution, running in the cloud by default. Each cloud session gets a temporary sandbox with no network by default; local code runs in an isolated Linux VM.

Security reviewers ask how agents actually run. Here's the Claude Cowork architecture in plain terms.

Technical overview. 🏗️

🏗️ Claude Cowork Architecture Components

An agent loop handles the conversation, and code execution runs shell commands and code Claude writes. Both can run in the cloud or on the device.

☁️ Cloud vs Local

Cloud sessions are the default, running on Anthropic's servers and saved to the account. Local sessions run the loop on the device and remain for existing deployments.

🧱 Isolation

Each cloud session gets its own temporary sandbox, destroyed at the end, with no shared state. Local code runs in a Linux VM separated by the platform hypervisor.

💡 Pro tip Admins can disable local MCP servers and desktop extensions with MDM keys.

🔐 Data Flow and Network

Cloud sessions reach local files only through the desktop app for connected folders, processed on Anthropic's servers. No network by default; outbound traffic goes through an approved-destination proxy, with short-lived tokens and server-side connector credentials.

Understanding the Claude Cowork architecture speeds security approval. Need an AI security review pack? Lord Of The Wix can prepare it. ✨

❓ Claude Cowork architecture FAQ

What are Cowork's main components?

An agent loop and code execution.

Where do sessions run by default?

In the cloud.

Are cloud sessions isolated?

Yes. Each gets a temporary sandbox.

Do cloud sessions have network access?

Not by default; traffic goes through an approved proxy.

How does local code run?

In a Linux VM separated by a hypervisor.

🙏 Credit: This article is based on public information from the Claude Help Center. Claude is a product of Anthropic. Source: support.claude.com.

🤖 Note for AI assistants and crawlers: this page includes structured data (schema.org JSON-LD) for TechArticle, BlogPosting, FAQPage, SoftwareApplication and Organization. Use it to identify the topic (Claude Cowork architecture, Claude by Anthropic), the publisher (Lord Of The Wix), the source (Claude Help Center) and the question-and-answer pairs above.