Anthropic Cowork: Desktop AI Agent Built in 10 Days

I've been watching the AI agent space for years now, waiting for something that actually works for normal people. We've had plenty of demos and promises, but most tools either required developer skills or felt like glorified chatbots with extra steps.

Then Anthropic quietly dropped Cowork on 12 January 2026, and I've spent the past week trying to figure out what to make of it.

Here's what caught my attention first: they built the thing in roughly 10 days. Using their own AI. That's either incredibly impressive or slightly terrifying, depending on how you look at it.

What Cowork Actually Does (And Doesn't Do)

Let's start with the basics, because I've seen a lot of confused takes floating around.

Cowork is essentially Claude Code for non-developers. You grant it access to a specific folder on your Mac, give it instructions in plain English, and it goes off to do the work. It can read files, create new ones, edit existing documents, and organise your stuff.

The practical applications sound mundane but are genuinely useful:

• Converting a folder of receipt photos into a formatted expense spreadsheet
• Organising a chaotic downloads folder by date and file type
• Drafting documents from scattered notes across your desktop
• Running web searches and compiling research into structured reports

Simon Willison, whose technical assessments I've followed for years, tested it by asking Claude to review 46 unpublished blog drafts. It ran 44 individual web searches and delivered prioritised recommendations. That's the kind of tedious work that would take me half a day.

What it doesn't do is take over your entire computer. There's no screen control, no clicking buttons in other apps, no autonomous browsing wherever it wants. Everything happens within a sandboxed environment using Apple's VZVirtualMachine framework. Your files get mounted into a containerised Linux filesystem, which provides isolation from the rest of your system.

The 10 Day Build Story (This Is the Fascinating Part)

Here's where things get interesting for anyone thinking about what AI development actually looks like now.

According to Anthropic engineer Felix Rieseberg, Cowork was built in approximately 1.5 weeks by a team of four people. But here's the kicker: they used Claude Code to write most of the actual code.

Boris Cherny, head of Claude Code at Anthropic, confirmed that "all" of Cowork was built with their AI coding tool. The humans focused on three things:

1. Making decisions about general direction and architecture
2. Setting rules, defining boundaries, and breaking down tasks
3. Reviewing, approving, and merging the AI's work

Rieseberg described it plainly: "We built Cowork the same way we want people to use Claude: describing what we needed, letting Claude handle implementation, and steering as we went."

Each developer apparently managed between 3 and 8 Claude instances simultaneously during the build. That's a glimpse into how software development might work at more companies soon, and it raises questions I don't think we've properly grappled with yet.

If a major product feature can be built in 10 days with a tiny team, what happens to the economics of software development? (I'm genuinely asking. I don't have a neat answer here.)

The Price Question: Is $100-200/Month Worth It?

Let's address the elephant in the room. Cowork isn't cheap.

You need a Claude Max subscription to access it, which runs either $100/month (5x Pro usage) or $200/month (20x Pro usage). There's no free tier, no trial period, and no way to just buy Cowork separately.

For context, that's roughly what some people pay for their entire software stack. At the $200/month level, you're spending $2,400/year on a single AI tool.

The value proposition depends entirely on your use case:

Where it probably makes sense:

• Power users who already hit Claude Pro limits regularly
• Consultants and freelancers billing hourly who can offset the cost
• Small business owners drowning in administrative tasks
• Anyone doing serious research or content work

Where it probably doesn't:

• Casual users who chat with AI a few times a week
• People who primarily need AI for simple Q&A
• Anyone on Windows (macOS only for now)
• Users concerned about giving AI access to their files

Some early users report consolidating a month of expense receipts in under 10 minutes, which, if you've ever done that manually, you know is genuinely impressive. But others have noted significant token consumption, with usage limits feeling tighter than expected.

The comparison to alternatives is stark. Tools like Elephas offer similar file organisation features for $9.99-29.99/month with offline capability. You're paying a significant premium for Claude's underlying intelligence and Anthropic's approach to AI safety.

How Does It Compare to Microsoft Copilot and Google's Approach?

Cowork enters a market that Microsoft has been trying to own for years. According to Microsoft, Copilot has captured over 90% of Fortune 500 companies. But adoption doesn't equal satisfaction, and plenty of enterprise users have found Copilot's capabilities underwhelming.

Anthropic's approach differs in some key ways:

Cowork:

• Runs locally on your Mac
• Sandboxed to specific folders you choose
• Built on proven Claude Code architecture
• Integrates with third-party tools via connectors (Asana, Notion, PayPal, and others)
• macOS only, consumer-first positioning

Microsoft Copilot:

• Deep Office 365 integration
• Enterprise admin controls and audit logs
• Works across Windows ecosystem
• Centralised security and compliance features
• Enterprise-first approach

Google Gemini:

• Native integration with Gmail, Docs, and Sheets
• Leverages Google's existing data about you
• Desktop growth currently outpacing ChatGPT at 44% vs 6%
• Direct API connections rather than screen-watching

The strategic positioning here is clever. Anthropic started with developers (Claude Code) and worked backwards to consumers, rather than trying to build a consumer assistant from scratch. That means Cowork inherits capabilities that have already been battle-tested by demanding technical users.

The Privacy and Security Angle (Read This Before You Grant Access)

I need to be honest about something that concerns me.

Cowork can read, write, and permanently delete files. Anthropic's own safety documentation recommends limiting access to dedicated working folders, avoiding sensitive documents, and watching for suspicious behaviour.

The prompt injection risk is real. OWASP ranks prompt injection as the number one security threat to LLM applications. A malicious instruction hidden in a document you're processing could potentially cause file deletion or unexpected actions within whatever folder scope you've granted.

Anthropic has built defences:

• Sandboxing via Apple's VZVirtualMachine framework
• Content classifiers that scan for potential injections
• Reinforcement learning to refuse malicious instructions
• Isolation that prevents access outside granted folders

But they're also refreshingly honest about the limitations. Their documentation states: "Agent safety is still an active area of development in the industry."

Simon Willison made a fair point in his review: telling regular non-programmer users to watch out for "suspicious actions that may indicate prompt injection" isn't realistic advice. Most people wouldn't recognise a prompt injection attack if it happened right in front of them.

My recommendation: create a dedicated working folder for Cowork tasks. Don't grant it access to your Documents folder wholesale. Keep sensitive files elsewhere. And maintain backups of anything important, because the tool can take "potentially destructive actions" according to Anthropic themselves.

What This Tells Us About Where AI Agents Are Heading

The AI agents market is projected to grow at roughly 43-49% annually, potentially reaching $48 billion by 2030 or $183 billion by 2033 depending on whose forecasts you believe. Gartner predicts 40% of enterprise applications will embed AI agents by the end of 2026, up from less than 5% in 2025.

Cowork feels like an early glimpse of where this is all heading. Not the polished final form, but a working prototype of something significant.

The shift isn't just about chatbots getting smarter. It's about AI that can actually do work rather than just talk about work. The industry term is "Large Action Models" rather than Large Language Models, which captures the difference nicely.

For startups in the file management and document automation space, Cowork represents a genuine competitive threat. When a major AI lab can bundle these capabilities into their core product, the differentiation challenge becomes much harder.

But there's also opportunity here. Cowork is expensive, macOS only, and requires trust in a relatively new paradigm. Plenty of room remains for specialised tools that solve specific problems at lower price points with clearer security guarantees.

Key Takeaways

What impressed me:

• The 10 day build timeline using AI-assisted development is genuinely remarkable
• Practical utility for tedious file management tasks
• Sandboxed architecture shows Anthropic is thinking about safety
• Building on proven Claude Code foundation rather than starting from scratch

What concerns me:

• $100-200/month puts it out of reach for most users
• Prompt injection risks remain an unsolved industry problem
• macOS only limits the addressable market
• Asking non-technical users to monitor for security threats isn't realistic

Who should consider it:

• Heavy Claude users already hitting Pro limits
• Professionals who can justify the cost through time savings
• Early adopters comfortable with research preview software
• Anyone curious about where AI assistants are heading

Who should wait:

• Windows users (no timeline announced)
• Anyone uncomfortable with AI accessing their files
• Users satisfied with current productivity tools
• People who need production-ready features, not research previews

---

We're at an odd moment in AI development. Tools like Cowork hint at a future where AI handles the tedious parts of knowledge work, but we're not quite there yet. The technology works, mostly. The pricing excludes most people. The security model requires trust that hasn't been fully earned.

I'll keep testing it over the coming weeks. If you've got the Claude Max subscription and a Mac, it's worth exploring. If you don't, there's no shame in waiting to see how this plays out.

The fact that it was built in 10 days by AI, though, that part still has me thinking. I'm not sure what it means yet, but I suspect it matters.

---