Quoting Felix Rieseberg

What it claims

Felix Rieseberg (Anthropic) describes two architectures for Cowork. In the "old" one, model inference ran in the cloud but tool calls executed in an Anthropic-provided VM shipped to the user's computer. The "new" one runs both inference and the VM in the cloud.

The page adds three points the summary leaves out:

• Why the local VM existed. It was there for "capability, safety, and security reasons". Specifically, it mapped in only the data the user explicitly added to the session.
• Session isolation. In the new design, each session gets its own sandbox and shares no state with other sessions.
• New uses the move enables. Rieseberg names using Cowork from a phone, as well as keeping work running after the laptop closes.

How it works

The trust boundary moves. Before, the sandbox lived on the user's machine and the user chose what was mounted into it. Now the sandbox is remote. When the cloud VM needs something on the user's device, such as a file, the desktop app executes that file-access tool call.

flowchart LR
  subgraph Cloud
    M[Model inference] --> V[Per-session VM sandbox]
  end
  subgraph Device
    D[Desktop app] --> F[Local files]
  end
  V -- "needs device file" --> D
  D -- "file access result" --> V

Old design, for contrast: inference ran in the cloud, the VM ran on the device, and only explicitly added data was mapped in.

Limits

• This is an excerpt, not the full statement. It contains an elision marked "[...]" and defers to a help page that isn't reproduced here.
• Data handling is unstated. The quote does not say how device file access is scoped or approved under the new design. It also doesn't say whether the old "only explicitly added data" guarantee still holds. If your threat model relied on the VM being local, check the help page before adopting.
• Rollout details are missing. There are no figures on cost, latency, availability, or migration, and nothing on whether the local-VM mode remains an option.
• The product description is broader than "coding." The page never calls Cowork a coding product. It describes it only as running Claude with tool calls in a VM.