Anthropic moves faster than most enterprises anticipated. A year ago, the primary concern was Claude Code: autonomous agents running on developer machines, writing and executing code, committing to repositories, invoking tools through MCP servers that nobody in security had approved. This was already a significant expansion of risk.
Today, that surface is much bigger, and it’s grown in a few different directions at once. Claude Code no longer belongs just to developers: non-developers in finance, HR, and marketing are writing their own workflows with it. Cowork puts an agent on the desktop of every employee on a Pro, Team or Enterprise plan, whether or not they’d call themselves technical. Dispatch takes that a step further, letting someone kick off an agent task from their phone and walk away while it runs on their desktop. Managed Agents skip the human entirely, running continuously in the background with their own permissions and their own access to data. Claude Desktop and Claude Chat remain how most employees meet Claude in the first place.
Noma provides security coverage across all of them: Claude Chat, Claude Code, Desktop, Cowork, Dispatch and Claude Managed Agents. 
Noma Capabilities Powering the Claude Ecosystem
Discovery and Inventory
Noma maintains a real-time inventory of every Claude instance, MCP Server, connector, tool and agent across your environment, mapped to individual identities. For most organizations, this inventory alone surfaces deployments and connections that security teams had no visibility into.
Access Control and Governance
Noma gives security and IT teams a centralized registry to define which agents, MCP servers, tools and skills are approved, which require review and which are blocked. Policies are enforced at runtime. If a user connects to an unapproved MCP server, Noma blocks the connection before any data flows.
Detection and Response
The AI-DR engine monitors the full interaction chain: prompt, model response, tool execution, downstream impact and intervenes when something is off. Every interaction is captured for audit. When something goes wrong, you get a full session timeline showing every prompt, response, tool call, and file operation in sequence, with the context to investigate rather than observe.
MCP Server Supply Chain Risk
MCP servers are the connectors that give Claude agents access to external tools, databases and services. They’re also the part of the stack with least governance by default, installed by individual developers or employees, often from unvetted sources, with permissions that exceed what the use case requires. Noma evaluates every MCP server in the environment: the permissions it requests, the data it can access, the trustworthiness of its source, and whether it exhibits patterns associated with the supply chain risk such as dependency confusion or susceptibility to rug pull. Servers that violate policy are flagged before they reach production, and blocked at connection time if a user attempts to connect to one that isn’t approved.
How Noma Supports Each Claude Product
Claude Chat
What it is:
Claude Chat is how most employees first encounter Claude. It’s the conversational interface available at claude.ai and through the Claude Desktop app, used across teams for drafting, research, summarization and general knowledge work.
Why it Matters to Security:
Claude chat is a productivity tool, but to security, it brings increased risk with employees sharing context they wouldn’t share anywhere else: customer data pasted into a prompt, internal financials used to draft a summary, confidential deal terms fed to Claude for analysis. Most organizations have no visibility into what’s being shared, by whom, or whether any of it violates data handling policy.
How Noma Covers It:
Noma connects to Claude Chat through the Claude’s Compliance API, available on Claude Enterprise. The integration polls chat sessions and messages, maps them to individual user identities, and surfaces the full interaction history in the Noma console for monitoring, policy review, and audit. No endpoint agent required. Coverage is established through the API connection at the organization level, and every session is evaluated against your AI-DR profiles.
- Flags sensitive data exposure: PII, credentials, regulated records
- Surfaces policy violations in interaction patterns
- Captures every session for audit and compliance
Claude Code
What it is:
Claude Code is a terminal-based agentic coding assistant. It runs on the developer’s machine, operates through the command line, and has the ability to read and write files, execute shell commands, interact with databases, commit to code repositories, and invoke external tools and services through MCP servers. It is designed to function autonomously over multi-step tasks.
Why it Matters for Security:
A typical Claude Code deployment looks like this: a developer installs it themselves, configures their own MCP servers to connect the tools they want, and starts using it that day. There is often no IT approval workflow, or visibility at the security team level.
The first problem security teams face is shadow deployment. Most organizations don’t know how many Claude code instances are running across their engineering organization, which MCP servers those instances are connected to, or what permissions those servers were granted.
The second problem is the threat is rarely a single bad prompt. It’s a sequence of legitimate-looking actions that adds up to exfiltration, scope violation, or manipulation. Claude code routinely processes content from untrusted sources: it fetches documents, reads code repositories, pulls API responses. Any of that content can contain hidden instructions designed to redirect the agent, causing it to exfiltrate data, execute unintended commands or escalate its own permissions without the developer noticing.
Noma monitors this with profiles, where each is built from detectors: prompt injection (including encoded and obfuscated payloads), sensitive data leakage (PII, PCI, secrets) with inline masking, malicious intent, tool poisoning, and more. AI Guardrails let you define custom detection logic in natural language. Every detector is independently tunable for sensitivity and action: monitor, alert, block, or mask.
How Noma Covers it:
AI-SPM
Noma finds Claude Code two ways by reading local config files to see which MCP servers and skills are set up on a given machine. Second, through CrowdStrike and Microsoft Defender for Endpoint, it can spot Claude Code activity on machines even where nothing’s been installed yet.
AI-DR
Noma’s plugin plugs straight into Claude Code and watches what the agent actually does: the command it runs, the file it touches, the prompts it sends. If something risky happens, reading a credentials file, a prompt injection hiding in a tool’s response, a secret typed into a prompt, Noma catches it before it goes through. New Claude Code deployments get sensible defaults out of the box, and teams can turn on deeper protections, like detecting hijack attempts hidden in tool responses.
For teams that route their AI traffic through a gateway, Noma plugs in there too, independent of whether the plugin above is installed. It works with the major gateways teams already use like Kong, Apigee, Azure, Portkey and LiteLLM, and every request gets tagged so you can trace it back to the right team or environment when something needs investigating.
This can be rolled out one developer at a time or pushed across an entire Mac fleet at once via MDM; Windows support is available today as a one-by-one install.
Claude Cowork
What it is:
Claude Cowork is Anthropic’s desktop AI environment for general business users. It launched early 2026, and is available on Pro, Team and Enterprise plans. This means it is accessible to every knowledge worker in an organization that has deployed it, not just the engineering team.
Cowork gives the Claude agent access to local files and folders, the ability to browse the web and interact with web pages, and the ability to fill out forms, and integration with enterprise applications through a growing library of connectors and skills. The user describes a task in natural language and Claude executes it autonomously across those surfaces.
Why it Matters for Security:
The attack surface for AI security expanded materially when Cowork became available to all employees. Claude Code was a developer problem, and now Cowork is an organization problem.
A business analyst using Cowork to prepare a report might direct Claude to pull data from internal systems, process documents containing confidential information, and export a summary to a shared location. Each step in that workflow involves data access decisions that happen without explicit security controls. If a document in that workflow contains a prompt injection payload, an instruction embedded in the content itself, not entered by the user, the agent can be redirected mid-task without the user ever knowing.
The connector and plugin ecosystem creates additional exposure and users can install connectors to link Cowork to external services. There is no default approval workflow for which connectors are permitted, what data they can access or whether their sources are trustworthy.
How Noma Covers it:
AI-SPM
Noma finds Claude Cowork through MDM, reading the local sessions files and schedules tasks it leaves behind. That gives you visibility into where Cowork is running and what it’s set up to do.
AI-DR
Cowork coverage operates through OpenTelemetry. Noma monitors the full interaction stream: prompts, model responses, file operations web and connector actions. Noma surfaces sensitive data leaks, prompt injection attempts, and behavioral anomalies for alerting and investigation. .for alerting and investigation. This OTEL integration is configured through endpoint management tools.
Claude Dispatch
What it is:
Dispatch is a feature within Claude Cowork that allows users to trigger Cowork agent tasks remotely from the Claude mobile app. The mobile app acts as a remote control: the user sends an instruction from their phone, and the Cowork session on their desktop executes it (all of this happens locally on the user’s machine).
Why it Matters for Security:
Dispatch introduces a new trigger vector for autonomous agent actions. Actions that previously required the user to be seated at their computer can now be initiated from anywhere, any time. The authorization chain is thinner: there’s no confirmation step on the desktop side and the mobile trigger happens outside the typical monitored desktop environment.
Anthropic notes the prompt injection risk directly and advises users to review their permission scope before using Dispatch on sensitive data. For security teams, the question is whether you have visibility into what tasks are being dispatched, what data those tasks are touching, and whether the outcomes fall within policy before something goes wrong.
How Noma Covers it:
AI-SPM
Dispatch runs through Cowork, similarly through MDM, where Noma maps what any dispatched task can actually touch. The Agentic Risk Map shows the connected MCP servers, connectors, and data sources tied to that agent, so you can see the blast radius of a task before it runs, not after.
AI-DR
Dispatch activity flows through the same OpenTelemetry pipeline as Cowork. Every dispatched task shows up in Noma with its full session timeline: the instruction that triggered it, what the agent accessed, and what it produced. Since tasks can be kicked off remotely from a phone and run unattended on the desktop, that timeline is what lets you confirm after the fact what actually happened during the run.
Claude Managed Agents
What it is:
Claude managed agents are Claude-powered applications and automated workflows built by an organization’s own teams, internal tools, customer-facing products, automated pipelines and multi-agent systems where Claude is one node in a larger orchestration. Unlike endpoint agents that run on individual machines, these agents typically run in cloud hosted environments, operate at scale and interact with production data.
Why it Matters for Security:
Managed agents often run with broader data access than endpoint agents because they’re designed to operate at scale. An agent processing customer records, generating automated decisions, or triggering downstream system actions represents a different category of risk than a developer using Claude Code on their laptop. Attack vectors like prompt injection through invested content, data leakage through model outputs, behavioral drift but with a much larger blast radius.
How Noma Covers it:
AI-SPM
Noma discovers managed agents through its cloud provider integrations (AWS, Axure, GCP) putting them in inventory alongside the models, tools and data they connect to.
AI-DR
For organizations routing managed agent traffic through an AI gateway, Noma integrates with Kong AI, GCP Apigee, Azure API Management, PortKey AI and LiteLLM. All traffic is instrumented, prompts, responses, tool calls and the metadata needed to trace interactions back to a specific application, environment and user identity. Traffic is tagged with an Application ID for clean separation in the Noma console.
For teams building agents in application code directly, Noma’s REST API integration gives full control: the application calls Noma on demand, and the same AI-DR engine scans and makes enforcement decisions within the application flow.
What Comes Next
Anthropic is shipping new capabilities faster than most security programs can keep up with. Dispatch is the most recent example, a genuinely useful feature that also introduces governance questions your existing tools aren’t built to answer. Who initiated the task? What did the agent access? Did any interaction violate policy?
These are answerable questions, but only if you have the instrumentation and enforcement in place before the capability is widely adopted.
If you want to see how Noma provides AI runtime protection across the Anthropic ecosystem, reach out for a demo.
