Cowork: Claude Code for Everyone Else?
Anthropic noticed what their users were actually doing.
Two weeks ago, Anthropic released Claude Cowork, a tool the company describes as “Claude Code for the rest of your work.” The pitch is straightforward: give Claude access to a folder on your Mac, describe what you want done, and walk away. It will organize files, generate spreadsheets from receipt screenshots, draft reports from scattered notes, and keep working while you do something else.
The product itself is interesting, but the story behind how it came to exist is more interesting still.
The Product That Built Itself
Claude Code launched in late 2024 as a terminal-based coding assistant, and developers used it to write and debug software, as expected. Then they started using it for everything else.
Boris Cherny, who leads Claude Code development at Anthropic, catalogued what they observed:
The fact that people were using a command-line coding tool to control kitchen appliances suggests the terminal interface and developer branding were limiting factors, not features. Claude Code’s real value was not the “Code” part but the underlying agent architecture that could plan, execute, and complete multi-step tasks with minimal supervision.
So Anthropic built Cowork: the same agent capabilities, wrapped in a visual interface that does not require comfort with command lines. And in a detail that feels both inevitable and slightly vertiginous, they built it using Claude Code itself, with the entire product written by Claude in approximately ten days.
What Cowork Actually Does
The core mechanic is folder-based access control: you designate a specific directory, and Claude gains permission to read, edit, and create files within that sandbox. According to Simon Willison’s reverse-engineering, the system runs inside a virtual machine using Apple’s Virtualization Framework, which provides isolation from the rest of your computer.
From there, the interaction model shifts from dialogue to delegation: rather than prompting Claude and waiting for each response, you queue up tasks and let it work through them in parallel. Anthropic’s description captures the intended feel: “much less like a back-and-forth and much more like leaving messages for a coworker.”
Early use cases cluster around the kind of tedious, structured work that sits at the intersection of “requires human judgment” and “takes too long to be worth it.” Lenny Rachitsky, host of a popular tech podcast, fed Cowork 320 episode transcripts and asked it to identify recurring themes and counterintuitive insights across hundreds of hours of conversation. Willison pointed it at his perpetually growing blog drafts folder and asked it to cross-reference against his published posts to find pieces close to completion.
Cowork also integrates with Anthropic’s existing “connectors” (links to external services), a growing library of “skills” (specialized instruction sets for tasks like creating presentations), and the Claude in Chrome extension for browser-based work, and when paired together, the theoretical surface area expands considerably.
The Awkward Middle
The early reviews are mixed in a specific way, with the capability clearly real but the user experience still unsettled.
Claire Vo, founder of ChatPRD, tested several tasks and found the outputs acceptable but noted that Cowork “exposes too much of its internal process for non-technical users, while also limiting flexibility for more advanced ones,” concluding that it currently occupies an awkward middle ground, neither simple enough for true novices nor powerful enough for expert users who might as well use Claude Code directly.
The Every team ran a two-hour livestream with early access and came away with a similar tension, assessing that “the UI is janky, but the concept excites me,” because the async workflow, the local computer access, and the skills integration represent something genuinely new, even if the interface needs polish.
And polish, for now, is explicitly deferred. Cowork launched as a “research preview” with known limitations: Projects, chat sharing, and Memory do not work; sessions do not sync to web or mobile; the product is macOS-only, with Windows support planned for mid-2026.
The Security Question
Anthropic devoted unusual space in its announcement to warnings, noting that Claude “can take potentially destructive actions (such as deleting local files) if it’s instructed to,” and advising users to provide “very clear guidance” about sensitive operations. The company explicitly flags prompt injection risks, where malicious instructions hidden in files or web content could manipulate Claude’s behavior.
Willison, who has written extensively about AI security risks, noted the tension between Cowork’s target audience and its security requirements, writing that he does “not think it is fair to tell regular non-programmer users to watch out for ‘suspicious actions that may indicate prompt injection.’” The people Cowork is designed for are precisely the people least equipped to recognize when an agent is being manipulated.
The sandboxing helps, and the virtual machine isolation means Claude genuinely cannot access files outside designated folders, but the product still requires users to trust an AI agent with write access to their data, a trust that is earned incrementally rather than granted by architecture alone.
What This Suggests
The most striking aspect of Cowork is not any single feature but the development velocity and feedback loop it represents.
Users discovered that Claude Code was a general-purpose agent, Anthropic noticed, and then Anthropic had Claude Code build a general-purpose agent interface, with the whole cycle from user behavior to shipping product taking weeks rather than the quarters or years typical of enterprise software development. This is not a hypothetical future where AI tools build themselves but rather the present production environment at Anthropic, where Cherny has reported that by December 2025, he had not opened an IDE in over a month, with Claude writing approximately 200 pull requests comprising every line of code he shipped.
Cowork is currently available to Claude Max subscribers ($100 to $200 per month), with access rolling out to Pro subscribers ($20 per month) as of January 16 and Team and Enterprise plans as of January 23. The pricing puts early access in enthusiast and business territory rather than mass consumer range, which is probably appropriate for software that can delete your files if you phrase a request ambiguously.
The competitive response will be instructive, and Willison’s prediction seems sound: “I would be very surprised if Gemini and OpenAI don’t follow suit with their own offerings in this category.” OpenAI’s existing “ChatGPT agent” mode handles browser automation but lacks local file access, Google has Project Mariner for web tasks, and neither has shipped a direct Cowork equivalent.
For now, Cowork is what it claims to be: a research preview that remains raw and early, but also genuinely novel in how it translates developer-grade agent capabilities into something a non-programmer can, with patience and caution, actually use.
This sounds like it could function as an AI form of a paralegal or some other position that a highly trained assistant would have. Is this a correct interpretation? (Understanding that Cowork is very early and raw.)