UK Business Hours: 9am - 5pm

AI Transformation21 Sept 2026Read: 13 min read

What the Claude Cowork merge means for your AI policy

Claude Cowork and chat merged on 16 Sep 2026. What changed, what Anthropic's own documents say, and three policy decisions to make in the next 30 days.

John Kelleher

What the Claude Cowork merge means for your AI policy

On 16 Sep 2026 Anthropic merged Claude Cowork and Claude chat into one product. Until then, a person on a paid plan chose to open Cowork before Claude could run code, work on files or act inside connected apps such as Microsoft 365, Gmail, Google Drive or Slack. Now there is no mode to choose. A person types what they want, and Claude decides whether that needs an answer or a piece of work.

That is a small change in the interface and a large one in the risk model. The AI policies we see written in 2025 and early 2026 describe a chatbot: a tool that produces text a person then acts on. The tool your staff open tomorrow morning can act. This post sets out what changed, using only Anthropic's public documentation, and the three decisions it forces on any UK business that pays for Claude.

What Anthropic has actually announced

The facts as of 21 Sep 2026, from Anthropic's announcement and Help Centre articles.

Claude Cowork and chat are one experience across web, desktop and mobile. Anthropic calls it the unified experience. Cowork is not being withdrawn: what Cowork could do is now available from any conversation, with the same connectors, skills, artifacts and files.
It is rolling out to individual Pro and Max plans over the next few weeks. Team and Free plans "will follow soon", with no published date.
For Enterprise plans, Anthropic's wording is: "Enterprise admins will hear from us at least 30 days before anything changes for their organizations." Nothing changes for an Enterprise organisation today.
Two new tools, Claude Docs and Claude Slides, launched the same day in beta on paid plans. Claude Design now runs inside conversations too. Enterprise admins choose when to turn these on.
By default Claude still asks before it takes an action. In Anthropic's words: "Claude asks before it takes actions, and you choose whether to allow each one." A person can switch a conversation to an automatic mode in which "Claude keeps working without stopping to ask about each step, and automated safety checks run before it takes an action."
Longer tasks run in Anthropic's cloud, so "more involved tasks keep running in the cloud even if you close your laptop or leave the page." Tasks that use files or applications on the person's own computer still need the Claude desktop app open.

Anthropic has not published pricing for the unified experience on business plans, so we will not guess at it. Questions about a specific organisation's plan or agreement go to that organisation's Anthropic account team.

Why this is a policy event, not a product update

Before 16 Sep, agentic work was something a person opted into by opening a different surface. After it, agentic work is something Claude may propose in the middle of an ordinary conversation, and a person may approve it with one click. Work that used to end as a paragraph of advice can now end as an edited spreadsheet, a sent message or an updated record in a connected system. Three things follow.

The boundary between "reading" and "doing" has moved into the conversation. An acceptable use policy that says "staff may use approved AI tools for drafting and research" no longer describes the tool. It needs to say which connected systems an agent may read from, which it may write to, and which it may send from. UK data protection law already draws a version of this line: since 5 Feb 2026 the Data (Use and Access) Act's replacement for Article 22 of UK GDPR turns on whether there was "meaningful human involvement in the taking of the decision". An agent acting without review on anything that affects a person is the scenario that test was written for. Our AI policy template for UK businesses already carries a clause for agents and write access.

Approval behaviour is now a setting, and someone has to own it. The default is safe: Claude asks before each action. But the person in the chair can change that for a conversation, and on Team and Enterprise plans there are organisation-level settings that govern what members may do. Anthropic's Help Centre lists an "Automatically approve" setting as on by default and an "Always allow" option for connector tools as off by default. The National Cyber Security Centre describes the same choice as three tiers: "Human-in-the-loop: humans approve actions before they happen. Human-on-the-loop: humans monitor actions and can intervene if needed. Human-out-of-the-loop: AI acts autonomously without human review." Its May 2026 advice is that you should be clear "who owns an agentic system, who approves its access, who monitors its behaviour, who reviews incidents, and ultimately who can stop it", and that those responsibilities are defined before the agent touches real data. Whoever administers your Claude organisation should be able to say, from memory, what the approval settings are and why.

Work now runs when nobody is watching. A task that continues in the cloud after the laptop closes is useful. It also moves the moment of review from "while it happens" to "when I come back". Your policy should say what a person is expected to check before they accept a finished deliverable, particularly where the task touched customer data or a live system.

What the security team should read, and what they will find

Two public documents cover how this work is contained, and they are the right reading for a security lead before the 30-day notice arrives: the Claude Cowork architecture overview in the Help Centre and Anthropic's engineering post "How we contain Claude across products" from 25 May 2026. Together they describe the cloud execution model. Each session gets its own sandbox, "created when the session starts and destroyed when it ends", and sandboxes do not share state across organisations. Outbound traffic passes through "a mandatory proxy the sandbox can't reconfigure or bypass, and only allow-listed destinations are reachable." Connector credentials are handled server-side, so "connector authorization tokens never enter the sandbox".

The same documents describe Cowork on desktop: the agent loop runs on the device and code runs in an isolated virtual machine with its own network filtering. Anthropic presents these as two places for the same work to run under the same organisation settings, and we describe them the same way. They are different, not ranked.

Two further points from Anthropic's own pages deserve a place in the security review, because they are the risks the architecture does not remove.

Prompt injection. Anthropic's Help Centre says plainly that "the risk of prompt injection attacks is non-zero" and recommends limiting access to sensitive files, monitoring for suspicious actions and restricting browser and web access to trusted sources. This is not theoretical. In January 2026 researchers at PromptArmor showed a document disguised as a Skill, carrying hidden white-on-white instructions, could make a Cowork session upload a user's own confidential file to the attacker's Anthropic account, because Anthropic's API sat on the allow-list the sandbox trusts. Anthropic's May engineering post describes a defensive proxy inside the VM that intercepts traffic to its API, and states that "protection in the model layer will never be 100% effective, which is why it can't stand alone." Treat prompt injection as a risk to reduce with scope and oversight, not a boundary that holds on its own. Our AI agent security review sets out the questions to ask.
Endpoint blind spot. The architecture overview states: "The VM is isolated from host-based security tools by design, and sessions in the cloud run entirely outside your endpoints, so EDR tools can't observe them either. If your compliance posture depends on endpoint visibility, account for this before rolling out Cowork." Cowork sessions are captured in the Compliance API instead, and Team and Enterprise owners can stream Cowork events to a SIEM through OpenTelemetry. If your organisation already logs Claude activity, check that the pipeline covers agentic sessions and not only chat.

Three settings from the Team and Enterprise documentation are worth knowing before you meet your account team. On Enterprise plans "Run Cowork in the cloud" is off by default; an owner turns it on and then grants the capability to a group using custom roles, which is the mechanism for piloting cloud execution with one team. On Team plans it is on by default. Cloud sessions use the same network-access setting that already governs Cowork on desktop and chat, with no network access as the Enterprise default; that setting does not cover web search, web fetch or connectors, and owners can turn web search off for the whole organisation under Capabilities. Owners can also require trusted-device enrolment and a recent sign-in for sessions in the cloud.

The three decisions to make in the next 30 days

If your organisation is on a Team or Enterprise plan, you have time. Use it on these three questions rather than on whether to opt in.

Which connected systems may an agent read, write and send from? Write it down per system. Reading a shared drive is a different risk from sending an email or updating a customer record. Our guide to Claude connectors explains what each connection exposes, and our post on what a personal AI agent should be allowed to touch in your CRM works through the question for one system in detail.
Who may switch off ask-before-acting, and for what? Decide whether members may use automatic approval at all, and if so for which categories of task. A reasonable starting position is: automatic for tasks that only produce files the person will review, manual for anything that writes to a shared system. The NCSC's August 2026 advice is to "ensure those approvals will be both guaranteed and gated" and not to "rely on prompting alone".
Who gets cloud execution first? The custom-roles mechanism exists so that one team can go first. Choose a team whose work is high-volume and low-blast-radius, run the security review against the documents above, and use what you learn to write the rollout rule for everyone else.

If your business runs on HubSpot, the companion post on what HubSpot admins should check after the Claude Cowork merge works through the same three decisions against HubSpot's own connector for Claude.

None of these need a new tool. They need a named owner, an hour with the Help Centre articles, and a policy that describes an agent rather than a chatbot.

How this compares with the other agent launches

Claude is not the only assistant that has learned to act. Between August and September 2026, OpenAI, Meta, Google, SpaceXAI and Microsoft each shipped or expanded an agent that can work inside a person's applications, and their defaults differ: some ask before every sensitive action, some flag only suspected misuse, and some are consumer-only with no business admin layer. Our comparison of this quarter's personal agents sets them side by side, and the three decisions above apply to every one of them. What is specific to Claude is the timing. For Pro and Max users the change is arriving now. For business plans the 30-day notice has not started, so the policy can be written before anyone has to use the new default.

SpotDev implements AI on Claude, on OpenAI's models and on HubSpot's own agents, and is a Claude Registered Partner and an OpenAI Select Partner. If you want a second pair of eyes on the policy and the settings before the rollout reaches you, start with our diagnostics or read how we approach AI implementation built around your systems.

Frequently asked questions

Is Claude Cowork being discontinued?

No. Anthropic has merged Cowork's capabilities into the main Claude experience. What Cowork could do is now available from any conversation, and existing Cowork tasks, projects, connectors, skills, artifacts and files carry over.

When will the unified Claude experience reach Team and Enterprise plans?

Anthropic says Team and Free plans will follow the Pro and Max rollout "soon" and has not published a date. Enterprise admins will be told at least 30 days before anything changes for their organisation.

Does Claude act without asking?

By default, no. Claude asks before it takes an action and the person approves each one. A person can switch a conversation to an automatic mode in which automated safety checks run before each action. On Team and Enterprise plans, owners have organisation-level settings that govern this.

Where does agentic work run in the unified experience?

Longer tasks run in Anthropic's cloud in a per-session sandbox, so they continue after the laptop is closed. Tasks that use files or applications on the person's own computer run through the Claude desktop app and need it open.

What should a UK business change in its AI policy?

Three things: name which connected systems an agent may read, write and send from; decide who may use automatic approval and for which tasks; and decide which team gets cloud execution first and what they must review before accepting a finished deliverable.