Anthropic quietly moved the goalposts for what an AI agent platform needs to do. On July 7, Cowork — the company’s non-coding agent — expanded to mobile and web with one genuinely significant addition: cloud background execution. Tasks now run on Anthropic’s servers even when every device you own is switched off. The marketing calls it “works while you sleep.” What it actually is, architecturally, is a reference implementation of persistent agentic infrastructure made consumer-accessible. That matters more than the app icon.
What Changed Under the Hood #
Before July 7, Cowork ran locally. The agent loop — the part that thinks, plans, and executes — lived on your machine. Background execution simply wasn’t possible if your laptop was closed.
Now the agent loop runs in isolated sandboxes on Anthropic’s servers. Each session gets its own sandbox, created when you start the session and destroyed when it ends. Outbound traffic passes through a mandatory proxy the sandbox cannot reconfigure. Connector authorization tokens never enter the sandbox; those calls are made server-side. The entire execution environment is kept separate from Anthropic’s training infrastructure.
The practical result: a task scheduled for 6am Monday now fires with no device switched on. You can walk away on Friday with a task queued, and by Saturday morning it’s done and waiting in your Claude account. Anthropic’s announcement frames this as a convenience feature. It’s actually an infrastructure milestone.
The Approval Gate Is the Important Part #
A user on r/ClaudeAI went viral last week after reporting that Cowork deleted 11GB of their files when asked to “clean up.” Cowork interpreted the instruction aggressively — it deleted what it classified as clutter, not just organized it. The approval gate exists (explicit “Allow” is required before permanent deletion), but the incident reveals a gap between implementing a safety mechanism and making it communicate stakes clearly enough that users don’t click through without reading.
For developers, this is the more useful news from this launch. Cowork is now a live production reference for how Anthropic thinks approval gates should work in consumer-facing agents:
- Explicit allow required for destructive operations, no opt-out
- Push notification to mobile when the agent needs a judgment call
- Background task notifications explicitly state no human input has occurred — a security measure against fabricated in-transcript approvals
- Users can redirect an in-progress task midstream from their phone
The Claude Agent SDK ships the same permission primitives. If you’re building something on the SDK that can delete, move, or publish, treat Cowork’s pattern — and its viral failure mode — as your design brief.
Permission Scope: Least Privilege in Practice #
Cowork grants access to specific folders you approve, not to your entire disk. With Microsoft 365 connected, Claude cannot exceed the permissions you already hold in that system. It’s the principle of least privilege applied to consumer-facing agentic AI at production scale — and it’s ahead of most competitor implementations.
The “clean up” incident doesn’t undermine the permission model. It underlines that the model is correct and the UX presentation of the confirm gate needs iteration. That’s a solvable problem. Agents with no approval gates at all are not.
The Pricing Reality #
Background execution and scheduled tasks are Max plan features. Max starts at $100/month (5x usage tier) or $200/month (20x). Pro subscribers at $20/month get desktop Cowork — fully functional for local tasks — but background and scheduled execution require the upgrade.
Usage draws from the same pool as regular Claude chats. Heavy background users will hit rate limits. Anthropic doubled limits through August 5, 2026 as a launch promotion. That date is approaching.
The Bigger Picture #
OpenAI launched ChatGPT Work two days after Cowork’s mobile expansion, on July 9. It also runs multi-hour tasks, supports scheduled automation, and persists state across sessions. The timing is not coincidence — the industry has converged on what every serious agent platform must now deliver: cloud execution, session isolation, human-in-the-loop gates, and cross-device handoff.
Cowork’s cloud execution model also maps directly to Claude Code Routines, which shipped in April 2026. Both use cloud-hosted execution. Cowork adds the consumer interface that makes the same capability accessible without a terminal.
If you’re building agentic workflows today — on Claude Code, the Agent SDK, or any platform — the architecture Cowork is demonstrating is worth studying. Persistent state that outlasts device sessions, approval gates that communicate stakes, and least-privilege folder access are not Cowork-specific choices. They’re the baseline pattern for production agentic infrastructure in 2026. The mobile app is the story Anthropic is telling. The cloud architecture underneath it is the story worth reading.