Claude Cowork
Security guidance for Claude Cowork, including workspace access, connectors, browser use, approvals, data handling, and agent activity evidence.
In short: Claude Cowork is an agentic work environment that can read and write files, run code, use connected tools, browse, and continue long-running tasks. Its local VM is an important boundary, but browser control and Computer Use can act outside that VM. Cowork activity is not currently covered by Anthropic audit logs, the Compliance API, or data exports.
What to focus on first
What is Claude Cowork?
Claude Cowork lets users delegate multi-step knowledge-work tasks to Claude. It can create documents and analyses, work across local folders, run shell commands and code, use plugins and MCP tools, browse the web, and schedule or remotely continue work.
Cowork is available through Claude Desktop, with remote sessions accessible from web and mobile. A remote session does not automatically reach the user's computer. Local file or browser access is bridged through an online Claude Desktop host and is limited to what that host exposes.
Where Claude Cowork runs and what it can access
Cowork has two main execution paths:
Local sessions: The agent loop runs on the endpoint. Code executes in a local Linux VM with mounted-folder, syscall, session, and network controls. File access is limited to folders the user shares.
Remote sessions: Work runs in an isolated, temporary Anthropic-hosted environment. It cannot reach private networks or the user's device by default. Access to local folders or a browser is mediated by Claude Desktop while that device is online.
Connectors use separately stored tokens. Anthropic states that connector tokens are not placed inside the Cowork sandbox. Local MCP servers, extensions, and browser bridges can still expand the reachable systems substantially.
Claude Cowork security boundary
The VM protects the host from ordinary file and code operations, but it is not a complete boundary for every tool.
Claude in Chrome can read pages, click, type, download, and use authenticated browser sessions.
Computer Use interacts with the real desktop and applications, outside the VM.
MCP servers and plugins can expose external systems, credentials, scripts, and hooks.
Documents, web pages, email, and tool output can contain prompt injection.
Endpoint detection tools cannot inspect activity inside the local VM, and cannot inspect remote sessions running on Anthropic infrastructure.
Cowork is not generally Zero Data Retention eligible. Confirm the exact data terms for the deployment path, including any third-party inference provider.
How to configure Claude Cowork securely
Control availability
Use the organization-wide Cowork toggle as the main enablement switch.
On Enterprise, use custom roles and groups to limit Cowork to approved users.
Control remote sessions separately from local desktop Cowork.
Require trusted-device enrollment and recent sign-in for remote sessions where supported.
Disable the ability to act without asking when the workflow does not justify persistent approval.
Limit files, tools, and network access
Use allowedWorkspaceFolders to restrict folders that can be mounted.
Disable local MCP with isLocalDevMcpEnabled when it is not needed.
Disable desktop extensions with isDesktopExtensionEnabled or use the extension allowlist.
Apply a restrictive network-access policy and allow only required destinations.
Keep Claude in Chrome disabled or on a short site allowlist during pilot rollout.
Treat plugins as executable supply-chain dependencies. Review their skills, connectors, agents, and hooks.
Do not grant broad shared credentials to tools that every Cowork user can invoke.
Approvals and monitoring
Require approval for deletion, external writes, sharing, credential use, and other high-impact actions.
Configure Cowork OpenTelemetry for Team or Enterprise deployments that require operational visibility.
Route telemetry to an approved collector and SIEM.
Redact prompt text, email addresses, file paths, shell commands, tool parameters, and other sensitive fields before long-term storage.
Do not treat OpenTelemetry as a compliance-grade audit trail. Cowork is not currently represented in audit logs, the Compliance API, or data exports.
Claude Cowork security review checklist
A named owner has approved the local, remote, browser, MCP, plugin, and Computer Use surfaces separately.
Only dedicated, low-privilege folders are mounted.
Network egress is deny-by-default or limited to approved destinations.
Browser access is disabled or site-allowlisted.
MCP servers and plugins have source review, credential scoping, and an update process.
Persistent approvals are disabled for high-impact tools.
OTel data is collected, redacted, protected, and correlated to identities.
Regulated workflows do not depend on audit evidence Cowork cannot produce.
Users understand prompt injection and review every external side effect.
Claude Cowork provider documentation
Applicable Harmonic guidance
Last reviewed: August 18, 2026
Related handbook guidance
Was this helpful?