# CrowdStrike plans to put Falcon Guardian inside Claude Cowork

> The planned integration would let security teams spot suspicious activity where Cowork carries out tasks. CrowdStrike describes it as pre-beta.

Source: https://fmcybersecurity.com/en/insights/ai-security/crowdstrike-falcon-guardian-inside-claude-cowork/
Locale: English
Other locale: https://fmcybersecurity.com/insights/ai-security/crowdstrike-planlegger-falcon-guardian-i-claude-cowork/

## Metadata

- Date: 2026-11-10
- Author: kenny-le
- Topic: ai-security
- Format: news
- Partner: crowdstrike
- Scope: international

**In brief:** CrowdStrike and Anthropic plan to put Falcon Guardian inside the environment where Claude Cowork carries out tasks. CrowdStrike listed the integration as pre-beta at its 3 November announcement.

A finance team could give Cowork a folder of receipts and ask for an expense report. Instead of explaining how to make the report, Cowork can open the files and create it. [Anthropic uses this example to explain Cowork](https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork). Access to those receipts makes the task possible. It also raises a security question: what if the agent tries to send a receipt somewhere it doesn't belong?

## Where Falcon Guardian would run

[In their Fal.Con Europe announcement](https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-extends-anthropics-claude-cowork-enterprise-ai), the companies describe placing a Falcon sensor inside Cowork's virtual machine. A virtual machine is a separate computing environment where software can run. The sensor is the part of CrowdStrike's security software that observes activity there.

Cowork's permissions still determine which resources the agent can access. Guardian has a different job: helping the security team detect suspicious use of that access while a task is underway. In the receipts example, opening a file is expected. An attempt to transfer it to an unexpected destination is the kind of activity the integration is intended to flag for investigation in Falcon.

The announcement describes Windows and Mac deployments. [CrowdStrike's technical overview](https://www.crowdstrike.com/en-us/blog/crowdstrike-advances-ai-security-and-safety-falcon-guardian/) labels this particular integration **pre-beta** and gives no date for general availability. For background on the wider product, see [what Falcon Guardian does](/en/insights/ai-security/what-is-falcon-guardian/).

---

For the full documentation index, see https://fmcybersecurity.com/llms.txt
For the complete corpus as a single document, see https://fmcybersecurity.com/llms-full.txt