CD Consulting R&D

KB-AI · Entry 3 · Published 2026-10-11 · Version 1

Assistant or agent? What Anthropic's merger of chat and Cowork moved across the line, and what it left in the user's hands

Anthropic merged its chat and its Cowork agent into one Claude on 16 September 2026, so the user no longer chooses between an assistant that answers and an agent that acts. This entry reads that decision against the research on agency, shows where the line now runs in the product (scope, mode, reversibility, identity, and a classifier), and weighs the numbers Anthropic publishes on human approval and prompt injection.

If you have ever let an AI tool act for you, or are deciding whether to, this is where the line between answering and acting now runs, who draws it, and the four settings that decide what happens in your name.

Analysis from Anthropic's announcements, help centre, product and engineering pages consulted on 11 October 2026, four research papers on agency in AI systems, and Article 14 of the EU AI Act. Figures are quoted with their date and attack suite; they are not comparable with one another.

Start here — if the subject is new to you

Until September 2026, Anthropic's Claude app offered two ways of working. In "chat" you asked and Claude answered. In "Cowork" you handed Claude a task and it went off to do it in your files, your browser and your connected accounts, then came back with the result. The first is an assistant; the second is what the industry calls an agent.

On 16 September 2026 Anthropic removed the choice. There is now one Claude, and it decides for itself whether your request needs an answer or an errand. This matters because the moment a system acts on the world in your name, the questions change: what may it touch, what must it ask before doing, who is responsible when it goes wrong, and how do you stay in charge without approving every click?

This entry defines the line between assistant and agent with the research literature, shows where Anthropic now draws it in the product, reads the numbers it publishes, and ends with the four settings that carry the distinction.

1. A product decision that is also a philosophical one
2. What the research literature means by "agent"
3. Nine months of a visible line: chat, Cowork, Claude Code
4. Where the line is now: four settings and a classifier
5. What the numbers say about the human in the loop
6. Three things that change for the person in whose name Claude acts
7. A frame for deciding how far to let it go
8. Sources

1. A product decision that is also a philosophical one

Anthropic's announcement of 16 September 2026 is short. Claude Cowork and chat "are now one Claude": the user no longer picks a mode, and "Claude determines what a task needs" [S1]. The help centre adds the practical consequences. Every conversation starts as a chat and, when a task needs code or files, moves into "an isolated, Anthropic-managed cloud sandbox", then returns to chat; once an account has the new experience it cannot go back to the separate options; incognito chats keep the old behaviour, so Claude cannot create files or run code in them [S2] [S6]. The rollout began with Pro and Max subscribers on web, desktop and mobile, with Team and Free to follow and Enterprise organisations promised at least thirty days' notice; on 11 October, Enterprise administrators still had the unified experience as an opt-in beta, "off by default" [S1] [S6].

Read as product news, this is a simplification: one box instead of two. Read as a statement about what Claude is, it is something else. For nine months, from the launch of Cowork as a research preview on 12 January 2026 to the merger, the application interface itself embodied a distinction that philosophers and safety researchers had been arguing about: on one side a conversational partner, on the other an agent that "takes actions on files rather than only replying", as the launch coverage put it [S5]. The user chose which one to summon. Now the system chooses, per request, and the distinction has not disappeared; it has moved. It lives in the permission settings, in the folders and connectors the user has granted, in a classifier that reviews actions, and in administrative policies. This entry is about that move: where the line went, and what it means for the person on whose behalf the acting is done. It follows the map of access channels published as the previous entry of this chapter [S22].

2. What the research literature means by "agent"

The word is older than the products. The standard textbook definition, from Russell and Norvig, is that an agent is anything that perceives its environment through sensors and acts upon it through actuators, and a rational agent is one whose actions are expected to maximise a performance measure given what it has perceived [S20]. By that definition a chatbot is already an agent: it perceives text and acts by producing text. The definition is too broad to carry the distinction the product made, which is why the recent literature has tried to make agency a matter of degree.

Three papers do this in compatible ways. Chan and twenty-two co-authors, writing for the FAccT conference in 2023, refuse "a definition of agency as a binary property" and instead name four characteristics whose presence, especially in combination, makes a system more agentic: underspecification of the objective, directness of impact on the world with little human mediation, goal-directedness, and long-term planning. They stress that recognising a system's agency does not reduce human responsibility for its harms [S17]. Shavit and colleagues at OpenAI, in a white paper of December 2023, define "the degree of agenticness in a system as 'the degree to which a system can adaptably achieve complex goals in complex environments with limited direct supervision'", and decompose it into goal complexity, environmental complexity, adaptability and independent execution; they too insist there is "no clear line along which to draw a binary distinction between 'agents' and current AI systems", and propose an initial set of seven practices for the parties in an agent's life-cycle [S16]. Gabriel and a large group at Google DeepMind, in 2024, define an advanced AI assistant as an artificial agent with a natural-language interface whose function is to plan and execute sequences of actions on the user's behalf, across one or more domains, in line with the user's expectations, and organise the ethical questions at three levels: the technology (value alignment, safety, misuse), the individual user (manipulation, anthropomorphism, trust, privacy) and society (access, misinformation, economic effects) [S18]. A fourth paper, by Kapoor, Narayanan and colleagues, looks at the same objects from the evaluation side and finds that the benchmarks used to rank agents reward accuracy alone, ignore cost, and lack hold-out sets, so that "agent" claims are often fragile [S19].

Two things follow for the case at hand. First, the line between assistant and agent is not in the model. The same Claude model answers a question and books a flight; what differs is the degree of underspecification it is allowed, the directness of its impact, and the supervision it receives. Second, the dimension that matters most for a user is the one Shavit's team calls independent execution and Chan's team calls directness of impact: how far the system can go before a human is in the loop again. That is exactly the dimension Anthropic's merger reorganised.

3. Nine months of a visible line: chat, Cowork, Claude Code

The line had a history before it was dissolved. Claude Code, the agent for software, arrived in the terminal in November 2024, got a web interface in October 2025 and a Slack integration soon after [S5]. Cowork, announced on 12 January 2026 as a research preview for Max subscribers, was described as "a more accessible version of Claude Code": the user picks a folder Claude may read or modify and gives instructions in the ordinary chat interface, with no terminal or virtual environment, "a sandboxed Claude Code instance" that runs on the same Agent SDK and the same model [S5]. Anthropic's own framing at launch is worth keeping: the risks of prompt injection and deleted files "aren't new with Cowork", but this "might be the first time you're using a more advanced tool that moves beyond a simple conversation" [S5]. The folder was the permission control.

By the time of the merger, Cowork had grown into something the product page describes as work handed over "across your files, apps, and browser": local folders on the desktop, connectors to services such as Microsoft 365, a built-in browser "separate from your own browser, logins, and tabs", computer use as "a last resort" in research preview, scheduled tasks that run in the cloud, and background execution that continues when the laptop is closed [S4] [S3]. The help centre says Cowork runs its sessions "in an isolated environment on Anthropic's servers" and reaches the user's machine only through the desktop app when a task needs something local [S3]. The same text carries two warnings that the chat side never needed: Cowork "has unique risks due to its agentic nature and internet access", and it "consumes limits faster than Chat" [S3] [S4].

So for nine months a user who opened the app made, in effect, a decision on Chan's fourth and Shavit's fourth dimension each time: stay in conversation, or grant independent execution. The merger removes that decision from the user and gives it to the model: "Claude determines what a task needs" [S1]. The obvious question is what replaces it.

4. Where the line is now: four settings and a classifier

The answer, assembled from the help centre, the product page, the enterprise guide and the Claude Code documentation, is that the line is now drawn by four kinds of setting, each of which existed before but none of which was the headline.

Scope: what Claude can reach. Folder access is granted per folder in the desktop app; connectors are chosen one by one; the cloud sandbox has a network-egress policy that an Enterprise administrator can set to off, package managers only, a custom domain list, or everything, and that is "off by default for Enterprise" [S2] [S3] [S6]. Anthropic's engineering post of May 2026 on containment calls this capping the agent's "blast radius", treats egress allow-lists "as capability grants, not just destination filters", keeps credentials in the host keychain rather than in the sandbox, and offers mounts that are read-only, read-write, or read-write-with-no-delete [S9]. Its first principle: "Design for containment at the environment layer first, then steer behavior at the model layer", because the deterministic boundary "is what holds when probabilistic defenses miss" [S9].

Mode: how often Claude must ask. The unified experience offers three modes, selectable in the message box. Manual, the default, asks for approval before actions. Auto approves read-only tools, lets Claude decide on writes and deletes, submits each action to a safety review, blocks unsafe ones, and falls back to asking if blocks keep occurring. Skip does not pause and, in the help centre's words, "nothing checks its actions automatically", to be used "only when you completely trust every action, connector, file, and app involved" [S3]. One action is carved out of every mode: permanently deleting a file requires explicit permission [S3] [S4]. On the Claude Code side the same architecture arrived earlier and with numbers. Since 14 August 2026 new sessions on Pro, Max and Team plans start in auto mode, where "a separate classifier model reviews actions before they run, blocking anything that escalates beyond your request, targets unrecognized infrastructure, or appears driven by hostile content Claude read" [S7] [S8]. The classifier's default block-list is published: downloading and executing code, sending sensitive data to external endpoints, production deploys and migrations, mass deletion on cloud storage, granting permissions, force-pushing, destroying files that existed before the session, merging a pull request no human has approved, and a dozen more; some categories are hard-denied and cannot be approved from inside the mode at all [S7] [S8].

Reversibility: what can never be undone silently. The deletion carve-out, the hard-deny list and the "irreversible, destructive, or aimed outside your environment" test are the product's answer to Chan's "directness of impact": the more irreversible the act, the more the line moves back toward the human [S3] [S7] [S8].

Identity: in whose name. This is the setting the user rarely sees as a setting. A Routine's commits "carry your GitHub user", its Slack messages and tickets "use your linked accounts" [S15]. The Chrome extension works "with your logged-in sessions" and the safety page states plainly that "you remain responsible for browser actions Claude takes on your behalf" [S13]. Dispatch, which lets a phone message start work on the user's own computer, warns that "phone instructions can trigger real actions on your computer" and that a phishing link "could lead to actions that are hard to reverse" [S14]. The agent does not act as itself; it acts as you.

Over these four sits the administrator. The enterprise guide shows how much of the line has become policy rather than personal choice: the "Skip all approvals" and "Automatically approve" modes can each be disabled organisation-wide; connectors can be set to "Blocked" or "Needs approval" per role, enforced "outside the sandbox on every connector call"; remote control and scheduled tasks are organisation-wide switches; the unified experience is not available at all to organisations on zero data retention, the HIPAA configuration or customer-managed keys [S6]. Anthropic's second containment principle says why: "Match isolation strength to the user's capacity for oversight" [S9].

5. What the numbers say about the human in the loop

Anthropic has published more measurement on this boundary than on most of its product, and the figures reward a careful reading.

The first set concerns prompt injection, the attack in which content the agent reads (a web page, an email, a form) carries instructions meant for it. The Chrome pilot of 25 August 2025 reported that, across 123 test cases in 29 scenarios, browser use without mitigations was hijacked 23.6 % of the time and, with mitigations, 11.2 %; on a browser-specific set (hidden form fields, injections through URLs and tab titles) the rate fell from 35.7 % to 0 % [S10]. On 24 November 2025 the research post on browser defenses reported a 1 % success rate against an adaptive "Best-of-N" attacker allowed 100 attempts per environment, and said "no browser agent is immune" and the problem is "far from a solved problem" [S11]. On 26 August 2026, at general availability, Anthropic described a stronger attack suite: before extra safeguards, attacks reaching the model succeeded 17.6 % of the time against Opus 4.5 and 3.8 % against Opus 5; with probes and the action classifier, none succeeded against Sonnet 5, Opus 5 or Mythos 5 and 0.3 % against Fable 5, all judged low-severity; an earlier Cowork test had reached 0 % and been retired as too easy [S12]. The help page for the extension puts the current figure for Opus 4.8 "below 0.08 %" and adds that "the chances of an attack are still non-zero" [S13]. The honest summary is that the number has fallen by two orders of magnitude in a year, that each figure comes from a different attack suite and is not comparable with the last, and that Anthropic itself keeps the environment layer in place because the model layer is probabilistic.

The second set concerns the human reviewer, and it is the more uncomfortable one. In the article announcing auto mode as the default in Claude Code, Anthropic reports that users approve 97 % of permission prompts; that in a comparison with 1,053 testers, humans caught 13.6 % of dangerous commands where the classifier caught 89 %, blocking 800 commands humans had approved while humans blocked 6 the classifier allowed; that in flagged sessions the rate of harmful unrequested actions at production severity was 6.3 % under manual approval and 2.4 % under auto mode; that an external red team (Apollo Research) brought the classifier's miss rate from 12 % to 7 % on synthetic attacks, a figure "not to be read as the rate on real traffic"; and that another (Trajectory Labs) saw none of 720 injection attempts succeed against the current models in auto mode [S8]. The article's conclusion is that manual review "often becomes habitual", and the product change follows: fewer prompts, a machine reviewer, and a short list of things it will never approve [S8].

Put the two sets together and the merger reads differently. The removal of the chat/Cowork choice is of a piece with the removal of the approval ritual: in both cases Anthropic has concluded that a decision the user was nominally making was not, in practice, being made, and has replaced it with a decision the system makes under published rules. Whether that is a loss of control or a gain depends entirely on whether the rules are legible to the person they protect.

6. Three things that change for the person in whose name Claude acts

Consent moves from the act to the boundary. Before, saying yes meant choosing Cowork, then approving actions. Now it means setting a mode once, granting folders and connectors once, and trusting the classifier in between. The ethics literature would call this a shift from consent per action to consent per capability. It is not new in computing (every operating-system permission works this way), but it is new for a conversational interface that most users still experience as talking to someone. The help centre's own advice recognises the gap: for "work with real consequences (money, messages sent as you, important files), stay close and review actions" [S3]. The law is moving the same way. Article 14 of the European AI Act, for high-risk systems, requires that they be "designed and developed in such a way … that they can be effectively overseen by natural persons", with measures proportionate to "the risks, level of autonomy and context", overseers able to understand the system's limits, remain aware of "automation bias", and intervene or interrupt it [S21]. The auto-mode article is, in effect, an argument that designed oversight (a classifier with a hard-deny list and a fallback to manual) satisfies that better than procedural oversight (a human who approves 97 % of the time). Most of what Claude does is not high-risk in the Act's sense, but the reasoning is the same reasoning.

Responsibility stays with the human and is now easier to overlook. Chan and colleagues' warning that agency "does not reduce human responsibility" is reproduced almost word for word in Anthropic's help pages: the browser user "remain[s] responsible", Routine commits carry the user's name, Dispatch acts on the user's machine [S17] [S13] [S15] [S14]. What has changed is visibility. When the user chose Cowork, the choice was a reminder that an agent was being dispatched. When Claude "determines what a task needs", the reminder is gone, and the user may discover after the fact that a request was treated as an errand. The Routine documentation shows the furthest point of this: a saved prompt runs "autonomously as full Claude Code cloud sessions: there is no permission-mode picker", with every included connector usable "including writes, without asking for permission during a run", and a green status that "does not mean the task in your prompt succeeded" [S15]. The agent's independent execution is at its maximum precisely where the human is absent.

The economics of autonomy become visible. Cowork "consumes limits faster than Chat"; auto mode "consumes more usage than the other modes"; the classifier's overhead was charged to users until August 2026 [S3] [S4] [S8]. Kapoor and colleagues argued that agent evaluation should optimise cost and accuracy jointly rather than accuracy alone [S19]; the subscription meter now does that for the user, by making every step of independent execution cost something. A user who notices the meter will, in practice, be making the assistant/agent decision again, through the budget rather than the interface.

7. A frame for deciding how far to let it go

For a small organisation or an individual professional, the four settings of section 4 give a checklist that does not depend on Anthropic's names for things, which will change again.

Scope first, mode second. Decide what Claude may reach (folders, connectors, egress, the browser profile) before deciding how often it must ask. A narrow scope in Skip mode is safer than a wide scope in Manual mode, because scope is enforced by the environment and approvals are enforced by habit [S9] [S13].
Match the mode to reversibility, not to convenience. Manual for anything that sends, pays, publishes or deletes; Auto for work inside a folder or a repository that is under version control; Skip only in a disposable sandbox. This is Anthropic's own recommendation restated, and it maps onto Chan's "directness of impact" [S3] [S7] [S17].
Treat identity as the most important grant. Everything an agent does with a linked account is attributed to the person who linked it. Separate browser profiles, dedicated service accounts where a platform allows them, and a review of what each connector can write are worth more than any mode setting [S13] [S15].
Budget as a brake. Usage limits and spend limits are a crude but honest measure of how much independent execution has been bought. Watching them is a form of oversight [S4] [S6].
Keep a trace. Routines and cloud sessions keep transcripts; Enterprise exposes a compliance API and OpenTelemetry export; the help centre recommends reading the run, not the status light [S6] [S15]. Oversight after the fact is still oversight, and for autonomous runs it is the only kind available.

Limits. This entry rests on Anthropic's public pages as consulted on 11 October 2026, four research papers and one article of EU law; it does not test the product, reproduce any of the published measurements, or compare Anthropic's boundary with those of other vendors. Several of the features described are in beta or research preview (the unified experience on Enterprise, computer use, Dispatch, Routines), and the help centre itself says accounts on the same plan may see different interfaces during the rollout. The attack-success figures come from internal and commissioned red-teaming with different suites and should not be read as a single trend line. The entry's framing (four settings, consent per capability) is the author's, not Anthropic's.

8. Sources

S1 Official (vendor announcement). Anthropic, "Claude Cowork and chat are now one Claude", Claude blog, 16 September 2026. https://claude.com/blog/cowork-is-now-claude — consulted 11 October 2026.
S2 Official (vendor help centre). Anthropic, Claude Cowork and chat are one Claude, Claude Help Center. https://support.claude.com/en/articles/16761823-claude-cowork-and-chat-are-one-claude — consulted 11 October 2026.
S3 Official (vendor help centre). Anthropic, Get started with Claude Cowork, Claude Help Center. https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork — consulted 11 October 2026.
S4 Official (vendor product page). Anthropic, Claude Cowork. https://claude.com/product/cowork — consulted 11 October 2026.
S5 Press. Russell Brandom, "Anthropic's new Cowork tool offers Claude Code without the code", TechCrunch, 12 January 2026. https://www.techcrunch.com/2026/01/12/anthropics-new-cowork-tool-offers-claude-code-without-the-code/ — consulted 11 October 2026.
S6 Official (vendor help centre). Anthropic, Set up and manage the new unified Claude experience for your Enterprise organization, Claude Help Center. https://support.claude.com/en/articles/17444462-set-up-and-manage-the-new-unified-claude-experience-for-your-enterprise-organization — consulted 11 October 2026.
S7 Official (vendor documentation). Anthropic, Choose a permission mode, Claude Code documentation. https://code.claude.com/docs/en/permission-modes — consulted 11 October 2026.
S8 Official (vendor article). Anthropic, "Auto mode is now the default in Claude Code for Pro, Max, and Team plans", 7 August 2026. https://claude.com/resources/articles/auto-mode-default-in-claude-code — consulted 11 October 2026.
S9 Official (vendor engineering blog). Anthropic, "How we contain Claude across products", 25 May 2026. https://www.anthropic.com/engineering/how-we-contain-claude — consulted 11 October 2026.
S10 Official (vendor announcement). Anthropic, "Piloting Claude for Chrome", 25 August 2025, with later updates. https://claude.com/blog/claude-for-chrome — consulted 11 October 2026.
S11 Official (vendor research post). Anthropic, "Mitigating prompt injections in browser use", 24 November 2025. https://www.anthropic.com/research/prompt-injection-defenses — consulted 11 October 2026.
S12 Official (vendor article). Anthropic, "Claude in Chrome is generally available", 26 August 2026. https://claude.com/resources/articles/claude-in-chrome-generally-available — consulted 11 October 2026.
S13 Official (vendor help centre). Anthropic, Use Claude in Chrome safely, Claude Help Center. https://support.claude.com/en/articles/12902428-use-claude-in-chrome-safely — consulted 11 October 2026.
S14 Official (vendor help centre). Anthropic, Pair the Claude mobile app with Claude Desktop (Dispatch), Claude Help Center. https://support.claude.com/en/articles/13947068 — consulted 11 October 2026.
S15 Official (vendor documentation). Anthropic, Automate work with routines, Claude Code documentation. https://code.claude.com/docs/en/routines — consulted 11 October 2026.
S16 Research (industry white paper). Yonadav Shavit, Sandhini Agarwal, Miles Brundage et al., Practices for Governing Agentic AI Systems, OpenAI, December 2023. https://cdn.openai.com/papers/practices-for-governing-agentic-ai-systems.pdf — consulted 11 October 2026.
S17 Research (peer-reviewed). Alan Chan, Rebecca Salganik, Alva Markelius et al., "Harms from Increasingly Agentic Algorithmic Systems", Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency (FAccT '23); arXiv:2302.10329. https://arxiv.org/abs/2302.10329 — consulted 11 October 2026.
S18 Research (preprint). Iason Gabriel, Arianna Manzini, Geoff Keeling et al., The Ethics of Advanced AI Assistants, Google DeepMind, arXiv:2404.16244, 2024. https://arxiv.org/abs/2404.16244 — consulted 11 October 2026.
S19 Research (preprint). Sayash Kapoor, Benedikt Stroebl, Zachary S. Siegel, Nitya Nadgir and Arvind Narayanan, AI Agents That Matter, arXiv:2407.01502, 2024. https://arxiv.org/abs/2407.01502 — consulted 11 October 2026.
S20 Reference work. Stuart Russell and Peter Norvig, Artificial Intelligence: A Modern Approach, chapter 2 "Intelligent Agents" (definitions of agent and rational agent), 4th edition, Pearson, 2020; wording checked against the chapter as reproduced in university course materials, e.g. https://www.cs.umd.edu/class/fall2003/cmsc421-0101/intelligent-agents.pdf — consulted 11 October 2026.
S21 Official (EU law). Regulation (EU) 2024/1689 (Artificial Intelligence Act), Article 14 "Human oversight", as published by the European Commission's AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-14 — consulted 11 October 2026.
S22 Related entry in this knowledge base. "One model, many doors: a dated map of every way to reach Claude in October 2026", KB-AI entry 2. https://www.cd-consulting-rd.be/KB-AI/7e5c.html — consulted 11 October 2026.