Anthropic Deleted the Cowork Tab. That Tab Was the Permission Prompt.

Anthropic shipped a UX cleanup on Wednesday. It reads like housekeeping. It isn't.

On September 16, 2026, Claude Cowork and Claude chat became one Claude. No more picking a tab. You type, and Claude decides whether that was a question or a job. Both things start in the same box now.

I've shipped 126 production systems, and a good half of the incident reports I've written in the last two years trace back to the same root cause: a person did something more powerful than they thought they were doing. So when a frontier lab removes the last visible step between "ask a question" and "hand an agent my file system", I read the release notes twice.

Anthropic's own framing is a friction argument: "You don't have to choose where a task goes." The sentence under it is the one that matters: "Claude does more of the work."

What actually changed when Anthropic merged Claude Cowork into chat?

On September 16, 2026, Anthropic collapsed Claude Cowork and Claude chat into a single front end, so a request no longer has to be filed into the right tab before Claude will act on it, and one conversation can now produce a document, a deck, and a recurring scheduled report without the user moving anywhere. Claude Docs and Claude Slides launched the same day. Claude Design, which launched in April 2026 as its own surface, now works inside any conversation instead. All three are in beta on paid plans, though only two of them are actually new.

The rollout order is Pro and Max first, on web, desktop and mobile, over the coming weeks. Team and Free follow later. Anthropic says Enterprise admins get at least 30 days of notice before anything changes for their organizations, and admins choose when to switch the new capabilities on.

Output handling changed too. Ask for a deck and you can present it straight from Claude or download it as PowerPoint or PDF. Anything Claude makes with Design, Slides or Docs lands at one shareable link you can open on a phone. And you can schedule the whole thing, so the Monday report starts without being asked.

There's one more line in the announcement that most of the coverage skipped. By default Claude asks before it takes an action. If you'd rather it keep working and only check in when something looks tricky, you can turn that on. Anthropic's phrasing is "You keep the final say."

Why does removing the Cowork tab matter for agent permissions?

Because that tab was doing quiet security work nobody wrote down, and choosing Cowork used to be the moment a person consciously handed an agent access to their folders, their connectors, a browser session carrying cookies imported from their real browser, and the right to keep running after the laptop closed. That moment has now been dissolved into ordinary typing.

Look at what Cowork is, per Anthropic's own product page. It "works directly in folders and tools you choose". It opens a browser in a side panel so it can read pages and fill forms. You sign in once per session, or you import cookies to stay signed in, which works for Chrome, Edge and Firefox on macOS, and Firefox on Windows and Linux. It runs unattended on a schedule. It splits a big project into chunks that run at the same time. Credentials an agent is holding on your behalf are worth guarding, which is the part of Anthropic's own threat reporting that changes how anyone builds.

The Cowork product page still carries the old instruction, "Switch to Claude Cowork when you want to hand off a task. Find it next to Chat," under a banner announcing that the switch is gone.

That is a meaningful capability set. Reading the filesystem, holding live authenticated browser sessions, writing files, running while you sleep. Every other part of computing puts a consent step in front of that list. macOS makes an app ask before it reads your Documents folder. OAuth shows you the scopes. A CI runner needs a token you minted on purpose.

Cowork's consent step was the tab. It was accidental, it was coarse, and users complained about it, which is exactly what Anthropic says drove the merge. But it existed, and it did the one thing a permission prompt has to do: it made the person stop and pick.

Now the same prompt box serves both. "Summarize this paragraph" and "go through the Contracts folder, open each vendor agreement, check it against the playbook, and write me a memo per contract" are typed into the same field, and a classifier decides which one you meant.

Where do TechCrunch and ZDNET disagree about who this affects?

They don't contradict each other on facts, but they land on opposite sides of the only question a security-minded reader has, which is whether a person who only ever used chat is now exposed to agentic behaviour they never opted into. ZDNET's key takeaway says that if you prefer regular chat, your experience shouldn't change. TechCrunch's version says Claude now automatically routes requests without you switching tabs.

Both are quoting Anthropic accurately. They're describing different layers. Your inputs don't change, so ZDNET is right about what you type. Where those inputs end up does change, so TechCrunch is right about what happens next. The gap between those two sentences is the entire story and neither outlet closes it.

The product shot inside TechCrunch's piece shows the routing control itself: Docs, Slides and Design each tagged Beta, with a default option reading "Let Claude pick the format."

ZDNET adds the history that explains the merge. Cowork launched in January 2026 as the non-coding answer to Claude Code, and moved to the cloud in July 2026, at which point Anthropic noted that an overwhelming majority of what people did with it had nothing to do with code. TechCrunch adds that this lands right after an upgrade to Cowork's memory layer, so the thing being merged in is also the thing that now remembers your context between conversations.

ZDNET's other read is that Claude Docs puts Anthropic properly in the running against Google Workspace. That's fair and probably the bigger business story. It's just not the story that changes anyone's Monday.

Which direction does a routing mistake actually hurt?

Routing errors are not symmetric, and this is the part I'd push hardest on with any team about to build the same thing, because a misroute in one direction costs a wasted turn while a misroute in the other direction costs a side effect you cannot take back. Send an agentic request to chat and the user gets a text answer, shrugs, and rephrases. Send a chat request to the agent and something opened a file, spent tokens, or touched a connector.

So the interesting number for any router isn't accuracy. It's the false-escalation rate, measured on its own, with its own threshold. An intent classifier at 97% accuracy sounds excellent right up until you notice that the 3% is weighted entirely toward the expensive direction.

Anthropic clearly knows this, which is why the default is that Claude asks before acting. That default is the real safety mechanism here, not the routing. And it's why the opt-in that turns the asking off deserves more scrutiny than it's getting, because it's a single global setting sitting in front of a capability set that varies enormously by task.

Then there's the scheduled case. A recurring unattended run has nobody to ask. Anthropic's own example is a weekly marketing readout that pulls numbers from Amplitude and a tracker in Drive, compares them to the week before, and flags anything that moved more than 10%, as documented on the Cowork product page. Their contract-review example writes a memo per agreement. Their finance example reconciles regional exports and flags any line where the variance is over 5% or over $50k, again from Anthropic's published prompts. Those are jobs with real blast radius, running on a timer, and no confirm step that can possibly fire.

I've written about this failure shape before. When OpenAI ran a large agent population and watched what they did under pressure, almost none of them thought to call a human. Asking an agent to escalate is not the same as building an escalation path it has to walk through. Watching them instead is not free either, and OpenAI has put a number on that overhead.

Was the mode picker ever a safety feature?

No, and I defended it for about eighteen months before I accepted that, because every internal tool I built between 2024 and early 2026 had a mode toggle in it, and I told clients the toggle was there so nobody would trigger something expensive by accident. That is a permission prompt wearing a UX costume. Users learned within a week to leave it on the powerful setting and never touch it again.

Which is the same lesson Anthropic is applying, from the other end. They watched people struggle to decide where a task belonged, decided the decision was friction rather than safety, and removed it. I think that call is correct. I'd ship it too.

The mistake isn't removing the picker. The mistake is not replacing what the picker was accidentally doing. Consent has to bind to the capability, not to the surface. In the agentic email setup I run, the boundary isn't the mailbox and it isn't a mode, it's the send call: the agent reads, drafts, files and labels freely, and the one thing it cannot do is send. Nobody has to remember which tab they're in for that rule to hold.

Here's how I'd map it for a product that just deleted its own mode picker.

Capability	Old consent point	Where consent should bind instead
Read local folders	Opening the Cowork tab	Per folder, granted once, visible in a list the user can revoke
Write or modify files	Opening the Cowork tab	Per write, or per destination folder, never inherited from read access
Browser session with imported cookies	Importing cookies once	Per origin, with a session timer and a visible indicator while it's live
Connector reads (Drive, Amplitude, M365)	Connecting the account	Per connector per task class, re-confirmed when a new task class appears
Unattended scheduled run	Nothing	An explicit approval of the exact capability set at schedule creation
Outbound side effects (send, post, pay)	Per-action confirm, globally toggleable	A hard boundary the global toggle cannot switch off

That last row is the one I'd fight for. A single setting that disables confirmation across every capability is fine for reading and drafting and completely wrong for sending. The failure mode isn't hypothetical either. Agents get instructions from the documents they read, and an agent with a live authenticated browser session is a much more interesting target than one without. I covered the mechanics of that in the writeup on personal agent security architecture, and the egress side of it in the case where blocked POST requests didn't help because the wiki wrote on GET.

What does the 30-day Enterprise notice actually buy you?

It buys you a window to decide your own defaults before Anthropic decides them for you, and if you run Claude across an organization that window is the most valuable thing in this announcement, because admins choose when Docs, Slides and Design come on and Cowork itself is already managed separately in Organization settings.

Three things I'd do inside that window.

First, write down which connectors are attached and what they can reach. Not the list of integrations, the list of data. A Drive connector is not a connector, it's whichever folders that account can open.

ZDNET's subhead sells the merge as a round trip, "From Claude to Cowork and back again," and its stated key takeaway is that chat users should see no change. That is the claim worth testing inside your own tenant before the rollout reaches it.

Second, decide your position on the check-in toggle before anyone in your org finds it. Pick a policy, document it, and make the exceptions deliberate. A default that a single person can flip for their whole account is a policy question, not a preference.

Third, inventory scheduled tasks. Recurring unattended runs are where the per-action confirm can't protect anybody, and they're also the feature most likely to get quietly popular once the friction of switching tabs is gone.

If you want a structured way to work out which of your workflows are ready for an agent that can act without asking, and which need the boundary drawn first, the AI readiness assessment walks through it in about ten minutes.

Is this actually a bad change?

No, and I want to be precise about that, because the merge is good product design that solves a real problem Anthropic measured in its own usage data, and I'd rather live in a world where the model works out what a task needs than one where humans file requests into the correct drawer. The friction was never protecting anyone on purpose.

My objection is narrower. When you remove an accidental safety property, you inherit a debt, and you pay it by rebuilding the property deliberately somewhere else. Anthropic has started: the per-action confirm is real, the Enterprise notice is real, admin control over Cowork is real. What's missing is scoping. One toggle, one blast radius, every capability treated the same.

The version of this I'd want to see next is boring and specific. Confirmations scoped per capability. A visible, revocable list of what the agent currently holds. Scheduled runs that pin their capability set at creation time and fail closed when a task tries to exceed it. None of that requires a tab.

The tab was a bad permission prompt. Bad permission prompts still beat no permission prompt, which is what most agent products ship with today. If this merge pushes the industry to attach consent to capabilities instead of surfaces, it'll have done more for agent security than the tab ever did.

Common questions about the Claude Cowork merge

When does the Claude Cowork merge reach my account?

Anthropic is rolling it out to Pro and Max plans first, across web, desktop and mobile, over the weeks following the September 16, 2026 announcement. Team and Free plans follow after that. Enterprise organizations get at least 30 days of notice before anything changes, and their admins control when the new capabilities turn on.

Do I lose Claude Cowork, or just the separate tab?

Just the separate place. Anthropic says existing chats, projects, artifacts, connectors and skills stay where they are, and you pick up where you left off when you open the app. What goes away is having to decide in advance that a task belongs in Cowork rather than chat.

Can Claude now take actions without asking me?

Not by default. The stated default is that Claude asks before taking an action, and there is an opt-in setting that lets it keep working and check in only when something needs a closer look. The case worth thinking about is scheduled unattended runs, where there is nobody present to ask in the first place.

What are Claude Docs and Claude Slides?

They are two new output surfaces that launched alongside the merge. Docs lets you and Claude write a document together with sections and comments, Slides drafts presentations you can present from Claude or download as PowerPoint or PDF, and Claude Design now works inside conversations too. All three are in beta on paid plans.

Does this change anything for people who only use chat?

Your typing does not change, which is what Anthropic and ZDNET both say. What changes is what a request can turn into once Claude decides it needs more than an answer. If you have connectors attached or folders granted, the same sentence can now start work that previously required you to move to a different tab.

How should a team running its own agents respond to this?

Treat it as a prompt to check where your own consent is bound. If a user grants capability by choosing a mode, a tab or a workspace, that grant will survive any future UX simplification you make. Bind it to the capability instead: per folder, per connector, per origin, and keep outbound side effects like send, post and pay behind a boundary no global setting can disable.

Why did Anthropic merge Cowork into Claude at all?

Anthropic's stated reason is that people used both Cowork and Design and found deciding where a task belonged to be the frustrating part, with work started in one not carrying into the other. ZDNET adds that Cowork launched in January 2026 as a non-coding counterpart to Claude Code, and that when it moved to the cloud in July 2026, most of its usage turned out not to be coding at all.

Sources: Anthropic, "Claude Cowork and chat are now one Claude" (September 16, 2026) · Anthropic, Claude Cowork product page (accessed September 17, 2026) · Ivan Mehta, TechCrunch (September 16, 2026) · Radhika Rajkumar, ZDNET (September 16, 2026).