Shares of SentinelOne, Inc. (ticker: S) fell 6.66% to $23.48 as the Mountain View, California-based cybersecurity company announced an expansion of its artificial intelligence security capabilities built around a new integration with Anthropic's Claude Cowork application.

The integration connects Anthropic's Claude Cowork application with SentinelOne's Singularity Platform and extends the company's security coverage into the virtual machines where AI agents carry out tasks on behalf of users. According to the company, it adds runtime monitoring and behavioral threat detection inside virtual machines, giving security teams visibility into AI agent activity and potential system threats.

The development targets growing security gaps created by the increasing use of autonomous AI applications. As employees delegate more work to AI agents, those tools gain access to business systems and sensitive operations, and security teams need better visibility into agent activity and potential threats. SentinelOne plans to address this challenge by placing its runtime security technology inside Claude Cowork's virtual machine, an approach that allows teams to monitor agent behavior and identify suspicious activity. The integration will also support automated responses when the system detects potential attacks.

Security Coverage Inside Claude Cowork

Claude Cowork operates within a virtual machine on an employee's device. Traditional endpoint security tools may not provide complete visibility into activities inside these environments. To close this gap, SentinelOne deploys its security agent directly within the virtual machine and connects it to the Singularity Platform.

This setup allows security teams to monitor system activity and identify unusual agent behavior, with the platform applying its existing runtime detection and response capabilities inside the virtual machine. The integration complements SentinelOne's endpoint detection and response and cloud workload security products, and it extends the company's recently introduced Singularity Agentic Detection and Response offering. Together, these capabilities expand protection across endpoints, cloud environments and AI applications.

Behavioral Detection and Automated Response

SentinelOne will use its Behavioral AI detection engine to examine activity inside Claude Cowork's virtual machine. The technology is designed to identify unusual actions and potential deviations from expected agent behavior, and security analysts can receive alerts when AI agents display suspicious activity.

The integration also provides agentic tracing, giving security teams greater visibility into automated operations and helping analysts identify potentially harmful actions before they affect wider systems. SentinelOne's runtime technology can autonomously stop detected attacks.

The company also plans to support Claude Cowork across macOS and Windows devices. Customers will control deployment through their existing device management systems, an arrangement that allows IT departments to determine which devices receive the integration and when activation occurs.

Building an AI Security Portfolio

The announcement follows SentinelOne's broader AI security strategy introduced at OneCon 2026, which aims to protect the systems and environments where organizations deploy AI technologies. The company's expanding portfolio addresses security requirements across endpoints, identity, cloud infrastructure and AI applications.

SentinelOne, headquartered in Mountain View, California, serves organizations across several industries. According to the company, its platform protects nearly one-fifth of Fortune 500 companies and hundreds of Global 2000 enterprises through its AI-powered cybersecurity products.

The Anthropic integration adds another layer to SentinelOne's strategy as businesses increase their use of AI agents. The company continues to develop tools that help security teams monitor automated workflows, strengthening its position in AI security as enterprise adoption creates new cybersecurity requirements. Deployment details, including support across macOS and Windows devices and IT-controlled activation through existing device management systems, frame how the integration is expected to reach customer environments.

Source: Blockonomi