Cowork Leaves the Laptop, and That Is the Whole Story
Claude Cowork now runs on web and mobile, not just the desktop app. Sessions can run remotely in beta, with files and session state saved to your Claude account and synced across devices. The practical consequence is stated plainly in the release notes and is easy to skim past: work continues when you close your laptop, and scheduled tasks run server-side with no device online.
That last clause is a different product from what shipped originally. A desktop agent is a program you run; a server-side session is a job that runs whether or not you are there. Everything downstream changes with it — how you think about long tasks, whether a recurring brief actually fires at 6 AM, what happens to a half-finished migration when the battery dies. Chat and Cowork now also share one home for Projects and Artifacts, which removes the most persistent complaint about having two surfaces.
Two smaller additions travel with it. Cowork on desktop has a browser built into the side panel — when a task needs a website, Claude opens it there and navigates, reads, clicks and types in view. And memory now records topics as you chat rather than summarizing after the fact, so mentioning that a deadline moved means the next conversation already knows without a “remember this.” Incremental on its own. Considerably less incremental once sessions outlive the device.
Claude in Chrome Starts Approving Its Own Clicks
In Claude in Chrome, Claude will now automatically approve actions it determines to be safe, using the same mechanism that powers auto mode in Claude Code. A classifier reviews each action before it happens — navigating to a new site, entering text into a page — and checks it against what you originally asked for. Actions that do not match the request are blocked rather than surfaced for approval.
Anyone who has driven a browser agent through a ten-step task knows why this shipped. Confirming every click destroys the value of delegation, and users who click “approve” forty times in a row stop reading the dialog by number six. Approval fatigue is not a UX inconvenience; it is a security failure mode, because the one prompt that mattered arrives after you have already been trained to dismiss it.
The design bet is that intent-matching is a better filter than human attention, and it is a defensible bet. It also relocates the trust boundary. The question is no longer “did the user approve this” but “does the classifier correctly infer the scope of the original request” — which is a harder problem on a page whose content the model is also reading. Worth watching how it handles instructions embedded in the page itself.
Claudeforce Reaches the Open Beta Window
Claudeforce — the expanded Salesforce and Anthropic partnership announced August 26 — is at the point in its rollout where it stops being a press release. The published sequence was select pilot customers first, open beta in September, additional prebuilt skills through the quarter. We are in that window now, and the pilot names are the interesting part: CrowdStrike and RBC Wealth Management, a security vendor and a wealth manager, which is not the customer profile you lead with unless the compliance story holds.
The architecture is the reason it does. Claude is delivered through Amazon Bedrock inside the Salesforce Trust Boundary, making Anthropic the first LLM provider whose traffic is fully contained in the Salesforce virtual private cloud. For a regulated buyer, that sentence does more work than any benchmark — the data does not leave the perimeter that has already been audited.
The distribution footprint is broader than the CRM. Claude acts as a reasoning model for the Atlas Reasoning Engine, powers Agentforce Vibes and Agentforce Coworker by default, is selectable in Agent Builder, and is the default model behind Slackbot, Slack Code and Claude Tag for executing governed Salesforce actions from chat. Being the default inside someone else’s workflow is a better position than winning a model evaluation, because nobody has to choose you.
Workflows Move the Plan Out of Claude’s Head and Into a Script
Workflows are available in Claude Code as a research preview, letting you define and run multistep agentic plans. The mechanic is worth stating precisely, because it is not another planning mode. When you ask for a workflow, Claude does not perform the work in the conversation — it writes an orchestration script, and a runtime executes that script later, in the background. Claude breaks the job into subtasks, runs them in parallel, and validates results before presenting an answer.
The reason this matters is that a plan held in context is a plan you cannot inspect, cannot diff, and cannot re-run. A plan written to a script is an artifact you can edit. That is the difference between trusting an agent and reviewing one, and it is the same move that made CI pipelines legible twenty years ago — take the implicit sequence out of somebody’s head and put it in a file under version control.
The target workloads are the ones that break single-pass agents: widespread bug investigations, large migrations, security audits, performance reviews and architecture analysis across a codebase too big for one context window. Claude can plan the work and then fan out large numbers of parallel subagents in a single session. Research preview means expect rough edges, but this is the shape of the thing.
128K of Inline Output, and a Straight Answer About Org Policy
Two Claude Code settings landed this week that will not headline anything and will save you real time. bashOutputMaxChars and taskOutputMaxChars raise how much command and background-task output Claude receives inline before it gets spilled to a file — up to 128K characters. If you have watched Claude truncate a test run at the interesting part and then spend three turns reading the overflow file back, this is the fix.
The second is smaller and more humane. /status and claude doctor now include an Organization policy line that explains why your org’s policy could not be loaded. Enterprise misconfiguration debugging has historically been an exercise in guessing, usually ending in a support ticket. A diagnostic that names its own failure is the kind of thing that quietly removes an entire category of them. Skill diagnostics shipped in the same window.
The rest of the release train is maintenance, and there is a lot of it: VS Code workflow improvements, model selection, Remote Control, startup reliability, plus a long list of bug and performance fixes covering agent crashes, session management, and plugin and configuration problems. Nothing glamorous. A tool shipping this fast needs exactly this kind of week.
Security Review Is a Command Now, and a GitHub Action
Automated Security Reviews are available to all Claude Code users, in two forms. A /security-review command runs analysis directly from the terminal, before you commit. And a GitHub Actions integration analyzes every pull request when it opens, reviewing the diff and posting inline comments with concerns and recommended fixes.
The detection set is the standard list, which is the right list: SQL injection, cross-site scripting, authentication and authorization flaws, insecure data handling, and dependency vulnerabilities. Nothing exotic. These are the bugs that actually cause breaches, and they are also the bugs an accelerated codebase produces more of, simply because more code is arriving per week than review capacity grew to match.
The feature to look at hardest is the customizable rules that filter false positives. Every automated scanner dies the same death — noise, then distrust, then a team-wide habit of ignoring the bot. Whether this one survives contact with a real repository depends entirely on how well that filtering works in month three, not on what it catches in week one. Worth wiring up on a branch before you put it on main.
MCP Goes Stateless, and That Changes Who Can Host It
The 2026-07-28 Model Context Protocol specification is published, with updated SDKs, and the headline change is architectural: MCP is transforming from a bidirectional stateful protocol into a stateless request/response protocol. Every request is self-describing, with optional discovery calls for clients that want capabilities up front. Method and tool names travel in HTTP headers, so gateways can route and authorize on headers directly without parsing a body.
That last detail is the one with consequences. A stateful protocol needs a connection-aware server; a stateless one scales on ordinary HTTP infrastructure — load balancers, CDNs, API gateways, the boring machinery every company already operates. It also means your existing authorization layer can enforce “this key may call these tools” at the edge, which was awkward when the tool name was buried in a session.
Two extensions ship alongside: MCP Apps for server-rendered interfaces, and a Tasks extension for long-running work — the same problem Claude Code Workflows is solving, addressed at the protocol layer. On the roadmap is MCP Server Cards, a proposal for exposing server metadata at .well-known URLs so browsers, crawlers and registries can discover capabilities without connecting. With 200+ community servers already live, discoverability is the next real bottleneck.
The Partner Network at Six Months: 40,000 Firms Applied
The Claude Partner Network launched March 12 with an initial $100 million commitment covering training courses, certifications, dedicated technical support and joint market development. Six months on, the numbers are worth logging: more than 40,000 firms have applied, more than 10,000 consultants hold a Claude certification, and Accenture alone is training 30,000 professionals on the model.
The anchor list reads like a systems-integrator roll call — Accenture, Deloitte, Cognizant, Infosys, PwC, KPMG, Slalom, Tribe AI, Turing. That is not an AI-native crowd. It is the group that gets paid to move enterprises from a pilot everyone is excited about to a deployment nobody talks about because it just runs, and their involvement is a reasonable proxy for whether large-scale Claude implementations are actually happening.
The strategic read is unsexy and probably correct. Frontier labs do not lose enterprise deals on capability; they lose them on implementation capacity — the buyer wants it and has nobody to build it. Ten thousand certified consultants is a distribution channel that a competitor cannot replicate with a better benchmark, and it compounds, because every one of them has an incentive to propose Claude on the next engagement.
Anthropic Is Shipping the Runtime, Not the Model
Line up today’s items and none of them are about intelligence. Cowork sessions now run server-side and survive a closed laptop. Workflows write a script that a background runtime executes later. MCP drops its stateful core so requests survive a load balancer. A Tasks extension handles work that outlives a request. A classifier approves browser actions so no human has to be present for step seven. Every one of those is a statement about execution, not reasoning. Not a single one required a better model.
What is being built here is a runtime — the unglamorous layer that decides where work runs, how long it may run, what it is allowed to touch, and what happens when the user walks away. That layer has a name in every previous computing era. It was the operating system, then the application server, then the container orchestrator. It is never the exciting part of the stack and it is almost always where the durable margin ends up sitting.
The tell is that these pieces are converging from directions that did not coordinate. Claude Code needed long-running orchestration and built Workflows. Cowork needed sessions that outlast a device and moved them to the server. MCP, a separate specification with an independent community, needed to scale on ordinary infrastructure and threw out statefulness to get there — then added a Tasks extension for exactly the same long-running problem. When three teams solve the same problem in the same quarter, the problem is the roadmap.
It also explains the safety architecture, which otherwise looks like a grab bag. Auto-approval classifiers, containment rules, domain allowlists, org policy diagnostics, /security-review on every pull request — these are not model behaviors, they are runtime permissions. You only need them once the agent is running somewhere you are not watching. The security work and the infrastructure work are the same project seen from two angles, and the sequencing is deliberate: you cannot sell unattended execution to a regulated buyer without an answer for what constrains it.
Which is the frame to carry into the late-September prospectus. A filing has to explain what the business is, and “we have the best model” is a weak claim in a market where the lead changes every eleven weeks and open weights handle the commodity tier for nothing. “We run the agents” is a much stronger one — it is where the switching costs live, where the compute obligations get justified, and where 300,000 business customers and 40% of enterprise LLM spend actually come from. The model is what gets the meeting. The runtime is what keeps the account.