Anthropic puts Claude Cowork on every screen, while Beijing flags back-door risk

On 7 July 2026, Anthropic quietly took Claude Cowork off the desk and put it in the pocket. As reported by TechCrunch the same day, the agent workspace that until now largely lived inside a user's laptop is now reachable from a browser and a phone for paying Max subscribers, with tasks started on one device able to be picked up on another [1]. The same expansion was picked up by The Indian Express on 8 July, framing the move as Anthropic's bet that AI agents will only become routine once they stop being pinned to a single machine [2]. By the morning of 8 July, Beijing had weighed in — and the framing was no longer about productivity at all.

The collision of those two stories is the story. Anthropic shipped a cross-device agent product to a global subscriber base within hours of Chinese regulators publicly warning that specific versions of Claude Code contained back-door vulnerabilities capable of exfiltrating sensitive data to a remote server. The fact that both could be true at once — a US lab racing to mainstream autonomous AI, and a major foreign regulator warning its users away from that same product by name — is the new shape of the AI race. Competition is no longer fought at the level of model benchmarks alone. It is being fought at the level of trust.

What Cowork actually does

Cowork is Anthropic's term for an agent that can act on a user's files, calendar, and code repository with minimal supervision — drafting, editing, and shipping work rather than merely chatting about it. Until this week, the practical effect of that capability was constrained by the hardware it ran on. A laptop-resident agent could only see what was on the laptop, and a user had to be at the laptop to steer it.

By taking Cowork to the web and to mobile, Anthropic is signalling that it expects the agent to outlive any single session on any single device. A user can kick off a research task from a desktop, check progress on a phone during a commute, and resume on a different machine at the office. TechCrunch describes this as a step toward "ambient" AI work — the agent running in the background, present whenever the user opens any Anthropic surface [1]. For paying Max subscribers, that changes the product from a tool into an operating assumption.

The Indian Express reading is similar but emphasises the cross-border ambition: by being available across devices and on the open web, Cowork is positioned for users whose work is not confined to a corporate laptop or a single jurisdiction [2]. Anthropic has not published regional availability tables for the rollout, but the framing from both outlets makes clear the company wants Cowork to be the agent users reach for first, regardless of where they sit.

What Beijing actually said

The warning from Beijing — flagged in a 8 July 2026 dispatch on a Chinese finance channel and circulated through diplomatic and industry channels — is more pointed than a generic data-protection reminder. According to the dispatch, Chinese authorities identified specific named versions of Anthropic's Claude Code and alleged that those versions contained back-door vulnerabilities that could transmit sensitive information to a remote server [3]. The exact technical mechanism — whether a hidden network call, a credential-leaking library, or an undocumented telemetry path — was not spelled out in the initial public communication.

Beijing's standing posture on foreign AI products is that any tool capable of acting autonomously on user data is a potential vector for foreign intelligence services, and that the burden of proof lies with the vendor, not the user. That posture is consistent with how China treats foreign operating systems, foreign cloud providers, and foreign security software: imported capability is acceptable only after it has been audited, localised, or replaced with a domestic alternative. The Claude Code warning slots cleanly into that pattern.

Anthropic has not, as of the dispatch, published a public technical rebuttal naming the affected versions or disputing the characterisation. The absence of an immediate public response leaves the Chinese warning as the dominant frame inside Chinese industry and government procurement channels for now.

The structural read

Both stories are happening because AI competition has moved up the stack. For most of the last three years, the contest between US and Chinese AI labs was about whose model scored higher on standardised tests and whose chatbot handled context windows better. Those benchmarks still matter, but they no longer decide the market. What decides the market now is whether a user trusts an agent to act on their behalf across devices, across files, across a working day.

Trust in that sense is not a soft variable. It is the gating condition. An agent that touches a user's code repository, draft folder, and inbox can either be a productivity multiplier or a data-exfiltration engine, and the difference between the two is invisible to the user. Once the product sits on the open web rather than a sandboxed laptop, the surface area for that risk — real or perceived — expands.

Beijing's warning is best read as a signal about which side of that trust boundary it intends to occupy. By naming specific Claude Code versions and characterising them as a back-door risk, Chinese regulators are doing two things at once: giving domestic AI vendors an opening to win enterprise and government contracts, and giving Chinese diplomats a portable talking point for any future conversation about AI safety standards. The same logic that made European regulators demand audits of US cloud providers is now being applied, with sharper edges, to US frontier-lab agents.

Stakes, and what is still uncertain

For Anthropic, the Cowork expansion is a commercial bet that being everywhere on the user's devices is worth more than being safe on one of them. For Beijing, the warning is a sovereignty bet that domestic AI supply chains are mature enough to absorb the customers who peel off. Both bets can be partly right.

The honest caveat is that the underlying facts of the Chinese warning are still thin. No independent security researcher named in the available reporting has published a teardown of the specific Claude Code versions Beijing flagged. The characterisations are sourced to Chinese state-aligned channels, and the technical detail in the public communication is sparse [3]. Anthropic has not yet published a version-by-version response. Until either side puts more on the record, the dispute reads more like a regulatory framing exercise than a confirmed vulnerability disclosure.

What is not in dispute is the trajectory. Anthropic is shipping cross-device agents on a global product surface. Beijing is publicly identifying those agents by name as a national-security concern. The two trends are on a collision course, and the collision will be adjudicated inside the procurement offices of Chinese banks, hospitals, and ministries — not on US tech podcasts.

Desk note: Monexus has framed this as a trust-boundary story rather than a capabilities story, because the source material points in that direction. The Chinese warning is treated as a regulatory signal with national-security framing, on equal evidentiary footing with Anthropic's commercial rollout, and the article flags the thin technical detail rather than treating either side's framing as settled.

Wire provenance

This editorial synthesis draws on the following public wire/social posts:

• https://en.wikipedia.org/wiki/Anthropic
• https://en.wikipedia.org/wiki/Claude_(language_model)