A technical dive into Claude Cowork's VM architecture, the Claude Agent SDK, MCP, and its security model. Anthropic's design validates the XO thesis: agents need secure workspaces, standard tool protocols, and humans in the loop.
Cowork runs inside a lightweight Linux VM with layered isolation: Apple's virtualization framework, Ubuntu, bubblewrap and seccomp, with network access through a domain allowlist. The agentic loop (observe, plan, act, reflect) is built on the Claude Agent SDK, and MCP is the extensibility backbone with more than a thousand community servers.
What this means for XO: bounded autonomy that earns trust is the pattern winning across the industry. Secure workspaces, standardized tool protocols, human-in-the-loop by default. It is exactly the architecture XO environments are built on.
VM isolation
Defense in depth: hypervisor, sandboxed runtime, syscall isolation, network allowlist.
MCP everywhere
The USB-C for AI. The same protocol XO uses to wire tools into every environment.
Bounded autonomy
Three action tiers, from auto-proceed to prohibited. Trust is the product.
Read the full articleAnthropic's architecture validates our thesis: the future isn't fully autonomous AI, it's bounded autonomy that earns trust.