Cortex XDR extends into Claude Cowork with lightweight sensor

Claude Cowork, part of Claude Enterprise, runs multi-step tasks inside a small local virtual machine designed as a security boundary. That isolation also blocks the endpoint detection and response agent from seeing what the AI agent does. Palo Alto Networks' answer is to put a lightweight sensor inside that virtual machine, extending runtime visibility without compromising host security. The sensor draws on Unit 42 Threat intelligence and machine learning models trained on global telemetry to block zero day threats by default. The Cortex platform then consolidates activity from inside the virtual machine and ties it back to the desktop in a single view. This builds on earlier Palo Alto Networks work with Anthropic: the company is a launch participant in Project Glasswing, which gives a small group of organizations early access to frontier AI for defensive cybersecurity, and it introduced Prisma AIRS Unified Data Protection for Claude to monitor prompts for data leaks and prompt injections.