Claude Cowork Merges Into Chat: What 'One Claude' Means for Security

On 16 September 2026, Anthropic announced that Claude Cowork — the mode it introduced for handing off longer, multi-step work — is being folded into the main Claude chat app. According to the announcement and reporting from Simon Willison and TechCrunch, the two become one product: bring Claude a quick question or hand it a report due at noon, and it keeps working on the task even after you've closed your laptop, with progress checkable later from another device.

What actually changed

• Chat, Cowork, and Artifacts are combined into a single interface that auto-routes requests instead of requiring users to switch tabs.
• Same-day launches: Claude Docs (draft, comment on, and export documents to Google Docs or Word) and Claude Slides (build and export presentations to PowerPoint or PDF).
• Claude Design, previously a separate feature, is now usable directly inside conversations.
• An upgraded memory layer lets Claude retain context across separate chats.
• Rollout starts with Pro and Max plans over the coming weeks, with Team and Free plans expected to follow.

Why a UI merger is a security story

On its face this reads as product tidying — Willison himself says he was "increasingly confused" by Cowork versus Claude versus Claude Code. But collapsing three surfaces into one general-purpose, cross-session agent changes the risk calculus, not just the interface.

• Persistent, closed-laptop execution means a misdirected or hijacked task keeps running unattended for longer, giving a prompt-injection payload more time and more tool calls before a human notices.
• Cross-chat memory widens the blast radius of memory poisoning: content planted in one conversation or ingested document can influence outputs in an unrelated later session.
• Native document and slide export add new, legitimate-looking egress paths — a manipulated agent now has a built-in way to move data out as a Word file, PDF, or shared link, no external connector required.
• Neither Anthropic's rollout messaging nor the coverage of it details the permission model for background tasks, connector scoping, or enterprise controls over memory retention — details that matter far more once "chat" and "autonomous agent" are the same product.

What to check before rolling this out

• Confirm whether admins can scope, audit, or disable cross-chat memory and background task execution for regulated data.
• Treat the unified Claude like any other agent deployment: review what tools and data it can reach unattended, not just what it says in a chat window.
• Test document and slide generation and export paths for prompt-injection-driven data exfiltration before pointing them at sensitive material.
• Revisit this once Team and Free tiers and any admin controls ship — the current public detail covers the consumer feature set, not enterprise governance.