Anthropic

Recently shipped Cowork as a Chrome side panel, subagent forking by default, and a restricted mode for Claude Code.

Cowork now lives in your browser.

sees the page you're signed in to — reads, clicks, types, and fills forms, with your skills, plugins, and connectors working in the browser for the first time. Conversations save to your history and live with your account, so a task started in a tab carries over to desktop or phone.

Subagent forking is on by default. A subagent_type: "fork" subagent inherits the full conversation and prompt cache, and non-teammate agent spawns in interactive sessions run in the background. Type @ to mention another Claude session by name, and cross-session messages can request a one-shot notify-when-idle.

Claude Code sessions can now run on your own infrastructure. claude self-hosted-runner turns your machines or containers into a place web, mobile, and desktop sessions execute, on Team and Enterprise plans, with server-supplied hooks. Runner sessions also gained --defer-shutdown-max-min and --proxy-authorization-command for egress proxies.

A new restricted mode strips Claude Code to file tools. --restricted (or CLAUDE_CODE_RESTRICTED=1) removes command-running and web-fetch tools, keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project, and local settings files.

Sandbox and permission hardening continued. Worktree-isolated sessions can't run destructive git commands against the main checkout, and sandbox.network.strictAllowlist denies non-allowlisted hosts without prompting. Credential files support mode: "mask" on Linux/WSL, JWT claims masking, and AWS SigV4 re-signing. GitLab token families are redacted, and Windows NT-namespace paths are rejected in pre-approval file accesses.

Marketplace controls expanded. strictKnownMarketplaces and blockedMarketplaces accept owner wildcards ("owner/*") to allow or block all repos under a GitHub org. Plugins can install from a zip over HTTPS with optional SHA-256 pinning, and new command sources resolve plugin directories per session. A warning fires when a requested subagent model is restricted and the parent model runs instead.