Claude Cowork: chat, local work, connectors, skills, plugins

What to understand

• Cowork is a desktop agent that returns deliverables, not advice. You give it a goal, 'turn these twelve PDFs into a quarterly summary deck', and it works autonomously on your computer, reading and writing your local files, and hands back the finished artefact. This is the key mental shift from chat: Chat tells you how to do the work step by step; Cowork does the work and gives you the output.
• It is desktop-only, on paid plans only. Cowork runs inside the Claude Desktop app for macOS and Windows, there is no web or mobile version of Cowork itself (though Pro/Max users can message a running task from their phone and get results back in the same conversation). It is gated to paid plans: Pro, Max, Team, and Enterprise. There is no free path.
• The deliverables are real office artefacts. Cowork produces Excel spreadsheets with working formulas (VLOOKUP, conditional formatting), PowerPoint presentations, formatted Word-style documents and reports, organised/renamed file structures, and data extracted from PDFs or screenshots into structured tables, the kind of output a knowledge worker would otherwise build by hand.
• It runs on a plan-then-approve loop. Cowork analyses your request, creates a plan, breaks complex work into subtasks, shows you the plan, and waits for your approval before proceeding, looping you in before anything significant. You can watch it work in real time or step away and review the finished deliverable. This is the same read-propose-act-observe discipline from Lesson 1, surfaced as an explicit approval gate.
• Code and shell commands run inside an isolated virtual machine, not on your bare OS. Anything Claude executes runs in a sandboxed VM separate from your main operating system; on macOS this is a real Linux VM. The agent can only see the folders you explicitly mount/connect, hard isolation, and outbound network traffic is constrained by an egress proxy with domain allowlisting, with arbitrary URLs blocked by default. This is why Cowork is often the safer first agent for non-technical users.
• Folders are how you grant file access, and you grant the minimum. You connect specific folders for a task; Claude reads and writes only inside them. Pair this with custom instructions. Global instructions that apply everywhere and Folder instructions scoped to a particular directory, so the agent carries the right context and constraints without you re-typing them each session.
• Connectors, MCPs, plugins, and skills extend what Cowork can reach. Connectors (Google Drive, Gmail, Slack, Linear, and more from the Connectors Directory) let Claude access your apps and take actions in them; you control which MCPs are connected and how often they ask permission. Plugins bundle skills, connectors, and sub-agents into one installable package from a marketplace (Knowledge Work is the default, plus Life Sciences, Financial Services, Legal, or your own GitHub-hosted marketplace). Skills are reusable instruction sets invoked with '/'.
• Connectors inherit your permissions and never exceed them. A connector can only reach what you can already reach in the source system, if you can't open a file, channel, or record there, Claude can't either through the connector. Custom connectors use remote MCP (Claude reaches your server from Anthropic's cloud, so it must be publicly reachable), and some plugins ship a local MCP server that runs on your machine, which is exactly why you install only from sources you trust.
• Two permission modes set the autonomy dial. 'Ask before acting' pauses for your approval at each significant step (recommended for sensitive work); 'Act without asking' runs faster with fewer pauses. Either way Claude still asks before permanently deleting files. This is Cowork's version of the Codex approval-policy / Claude Code permission-mode dial you met earlier.
• Projects, memory, and scheduled tasks make it a recurring workhorse. Projects group related tasks into workspaces with their own files, context, instructions, and memory; memory persists inside a Project but not across standalone Cowork sessions. You can also save tasks and have Claude run them on demand or automatically on a cadence, turning a one-off brief into a recurring report.

Deeper dive

Claude Cowork vs Claude Code, when to reach for which

Same underlying agentic engine, two envelopes. Route by the shape of the deliverable: a document/artefact a person consumes (Cowork) vs a code change/diff in a repo (Claude Code). Surfaces, defaults, and availability change fast as both ship rapidly, verify at the official docs linked below before relying on specifics.

Sources (as of June 2026): Anthropic. Claude Cowork product page · Claude Help. Get started with Claude Cowork · Forte Labs. The difference between Claude Code and Cowork · Claude Code overview

Step by step

1

Confirm Cowork eligibility and the surface

12

Open the Claude Desktop app on macOS or Windows and find Cowork. Confirm two facts before you plan any work: (a) Cowork is desktop-only, there is no web or mobile Cowork (Pro/Max can message a running task from a phone, but the work runs on the desktop), and (b) it requires a paid plan (Pro, Max, Team, or Enterprise). If you only have web/mobile access or a free plan, that's your blocker to resolve first. You're in the right place when you see the home screen shown here, 'Let's knock something off your list', with a task composer.

HintIf you're trying to do this in a browser, you're in the wrong place. Cowork lives in the desktop app, not claude.com.

On this screen

1. 1Desktop-only surface. Cowork is a Claude Desktop feature, verify you're in the app, not the web client.
2. 2'Learn how to use Cowork safely' link. Anthropic's own safety primer, linked right on the Cowork home screen, read it once; it covers the same folder and connector boundaries this lesson drills.

2

Decide: document or diff?

Before opening Cowork for a task, name the finished output in one line and ask where it lives. If it's an artefact a person consumes (a spreadsheet, deck, report, or organised folder) it's a document. Cowork. If it's a change to a codebase (an edit, test, refactor, or commit) it's a diff. Claude Code. Write down the task you're about to run and which side of the line it falls on, and why.

HintRoute by the shape of the output, not by which tool is already open. Forcing a deck through a terminal, or a refactor through a chat box, is the most common mis-route. The shorthand: document → Cowork (GUI, VM sandbox, office output); diff → Claude Code (terminal/IDE, git, per-step review).

3

Scope a folder and set instructions

1

Connect ONLY the folder this task needs, in Cowork the mounted folder is the security boundary, so a tight folder is a tight blast radius. Then set custom instructions: a short Global instruction for how you always want Claude to behave, and a Folder instruction scoped to this directory for task-specific context (audience, tone, naming conventions). This carries your standing safety preamble from Lesson 1 into Cowork without re-typing it. Once connected, the folder shows as the task's workspace in the composer, if you can't see which folder is attached, stop and reconnect before sending anything.

HintDon't mount your whole home directory 'to be safe', that's the opposite of safe. Mount the one folder the deliverable lives in.

On this screen

1. 1'Choose a different folder'. Claude Desktop's folder picker, the same menu Cowork uses to connect a folder. Pick the one folder the deliverable lives in, nothing broader.

4

Add only the connectors and plugins the task needs

12

If the task needs an app (Drive, Gmail, Slack, Linear, etc.), add that connector from the Connectors Directory and authenticate; for a bundled capability, install a plugin from a trusted marketplace (Knowledge Work is the default). Read what a plugin bundles before installing, some carry a local MCP server that runs on your machine. Then, per conversation, toggle on only the connectors this task requires and leave the rest off. Done when only the connectors this task needs show enabled for the conversation and the rest stay off.

HintA connector never grants more than your own access, but the safest connector is the one you didn't enable for a task that didn't need it.

On this screen

1. 1Plugins row. Plugins can ship a local MCP server, install from curated/known marketplaces you trust.
2. 2Connectors submenu. Enable only the connectors the current conversation needs; turn off the rest. The warning badge beside Connectors flags one needing attention, check it before running.

5

Run the plan-then-approve loop

12

Give Cowork the task using the production brief pattern from this lesson: a clear deliverable, the in-scope folder, 'plan first then stop for approval,' and 'don't invent missing data.' Keep the permission mode on 'Ask before acting' so Claude pauses at significant steps; switch to 'Act without asking' only for low-stakes, well-understood tasks. Review the plan it proposes before you approve, then watch or step away. Success at this step is a posted plan and a paused agent. Cowork should be waiting on you, not building.

HintRead the plan, not just the result. The plan is cheap to inspect and free to reject; a wrong-but-finished deliverable costs you the rebuild.

On this screen

1. 1'Ask mode' chip. 'Ask before acting' pauses at each significant step, keep it on for sensitive work; deletes are always confirmed either way.
2. 2'Project scoped' chip. The task runs against the one folder you connected, confirm both chips before you hit Start task.

6

Verify the deliverable before you ship it

12

Open the finished artefact and verify it the way Lesson 8 taught for code: spot-check three to five figures against the source PDFs, click into spreadsheet cells to confirm real formulas rather than pasted numbers, and read the deck against the brief's slide spec. If anything is wrong, ask Cowork to revise in the same task so it keeps full context. You've verified properly when you can name the exact cells or figures you checked and what they matched against.

HintA polished deck with one fabricated figure is worse than no deck, the formatting hides the error. Verify the numbers, not the formatting.

On this screen

1. 1'Source facts checked'. Verification is a step, not a vibe, confirm figures against the inputs before accepting.
2. 2Accept / Ask to revise. Refine in the same task so Cowork keeps the context of what it built and why.

7

Save it as a recurring task or Project

If this is work you'll repeat (a weekly report, a monthly board pack, a recurring data pull), save the task so Claude can run it on demand or on a cadence, and consider grouping related tasks into a Project, its own files, context, instructions, and memory. Note that memory persists inside a Project but not across standalone Cowork sessions, so put anything that must carry over into the Project. You'll know it worked when the saved task appears in your task list, or the Project shows the grouped files and instructions.

HintTurn a good one-off brief into a scheduled task once it's proven, that's where Cowork stops being a chat and starts being an operations layer. What's safe to run unattended, and how to bound it, is Lesson 12's whole subject.

Production prompt examples

ROLE: You are a meticulous analyst producing a finished, client-ready deliverable. I review your plan before you build anything.

CONTEXT:
- Surface: Claude Cowork (desktop). The only folder in scope is the connected folder "Q2-board-pack". Read and write ONLY inside it.
- Inputs in that folder: ~12 monthly PDF exports (revenue, churn, headcount) named like "2026-04-metrics.pdf".
- Audience: the board. Tone: concise, factual, no hype.

TASK: Produce two deliverables in the same folder:
1. "Q2-summary.xlsx", one row per month, columns for revenue, MoM growth %, churn %, headcount. Use real working formulas for the growth and any totals (not pasted numbers).
2. "Q2-board-summary.pptx", 6 slides max: title, the quarter in one chart, three highlight slides (one metric each), and a one-slide outlook. Pull every number from the xlsx.

CONSTRAINTS:
- PLAN FIRST: show me your step-by-step plan and which files you'll read/create, then STOP and wait for my approval before doing anything.
- Keep "Ask before acting" behaviour: pause before overwriting any existing file, and never delete anything without asking.
- Do not reach any network domain or connector you weren't given; everything you need is in the folder.
- If a PDF is unreadable or a number is missing, list it and ask, do not invent or estimate figures.

OUTPUT FORMAT:
1. Your plan as a short numbered list (then stop for approval).
2. After I approve: the two files in the folder, plus a 3-line note on what you built and any data you flagged.

Common mistakes to avoid

• Mis-routing the task: forcing a code refactor through Cowork (losing per-step diff review and git) or forcing a document/deck through Claude Code (fighting a terminal to do GUI work).
• Looking for Cowork on the web or mobile, it's a desktop-app-only feature on paid plans; there is no free or browser Cowork.
• Mounting your whole home directory 'to be safe', in Cowork the connected folder is the blast radius, so a broad mount is a broad risk.
• Trusting the VM sandbox to cover everything, it limits what Claude can reach, but a connector still inherits your real permissions, so a misled agent can still email the wrong person or write a bad file into a mounted folder.
• Installing plugins from untrusted sources without realising they can bundle a local MCP server that runs on your machine.
• Leaving every connector toggled on in every conversation instead of enabling only what the task needs.
• Running 'Act without asking' on sensitive work to save time, then being surprised by an action you'd have stopped at the plan stage.
• Expecting memory to carry across standalone Cowork sessions, it persists inside a Project, not between one-off chats.

Source conflicts to review

• Cowork's general-availability date is reported inconsistently across sources (e.g. macOS+Windows via Claude Desktop on 9 April 2026 vs an earlier macOS launch on 12 Jan 2026 with Windows on 10 Feb 2026). Treat exact dates as uncertain and confirm on Anthropic's own pages.
• Comparative claims about Cowork burning quota faster and Claude Code being more 'reliable on complex tasks' come mostly from third-party blogs, not a published Anthropic benchmark, directionally useful, not authoritative.
• Feature names and permission-mode labels (e.g. 'Ask before acting'/'Act without asking', Global/Folder instructions) ship and rename quickly, verify in the in-app UI and the official help article before relying on exact wording.