> For the complete documentation index, see [llms.txt](https://handbook.harmonic.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://handbook.harmonic.security/by-ai-vendor/anthropic/claude-cowork.md).

# Claude Cowork

Security guidance for Claude Cowork, including workspace access, connectors, browser use, approvals, data handling, and agent activity evidence.

{% hint style="warning" %}
**In short:** Claude Cowork is an agentic work environment that can read and write files, run code, use connected tools, browse, and continue long-running tasks. Its local VM is an important boundary, but browser control and Computer Use can act outside that VM. Cowork activity is not currently covered by Anthropic audit logs, the Compliance API, or data exports.
{% endhint %}

## What to focus on first

<table data-view="cards"><thead><tr><th></th><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><h3><i class="fa-user-shield" style="color:$primary;">:user-shield:</i></h3></td><td><strong>Control who can use Cowork</strong></td><td>Treat the org-wide Cowork toggle, RBAC, group assignment, remote sessions, and trusted-device rules as the rollout gate.</td><td><a href="/handbook/1.-identity-and-access/1.2-rbac-across-ai-platforms.md">1.2 RBAC across AI platforms</a></td></tr><tr><td><h3><i class="fa-box" style="color:$primary;">:box:</i></h3></td><td><strong>Test the sandbox boundary</strong></td><td>The local VM limits ordinary file and code operations, but browser control, Computer Use, MCP servers, plugins, and remote sessions can expand the real boundary.</td><td><a href="/handbook/3.-runtime-sandbox-and-autonomy/3.1-what-even-is-an-ai-sandbox.md">3.1 What Even is an AI Sandbox?</a></td></tr><tr><td><h3><i class="fa-plug" style="color:$primary;">:plug:</i></h3></td><td><strong>Limit tools before rollout</strong></td><td>Cowork can use connectors, MCP, extensions, skills, hooks, browser bridges, and shared credentials. Review each one like a supply-chain dependency.</td><td><a href="/handbook/2.-supply-chain-and-extensibility/2.1-connectors-and-apps-the-integration-backbone.md">2.1 Connectors and apps: the integration backbone</a></td></tr><tr><td><h3><i class="fa-triangle-exclamation" style="color:$primary;">:triangle-exclamation:</i></h3></td><td><strong>Assume prompt injection</strong></td><td>Files, web pages, email, tool output, tickets, and docs can all carry instructions that try to steer the agent toward unsafe actions.</td><td><a href="/handbook/5.-threats-and-adversarial/5.1-prompt-injection-the-connective-risk.md">5.1 Prompt injection: the connective risk</a></td></tr><tr><td><h3><i class="fa-route" style="color:$primary;">:route:</i></h3></td><td><strong>Collect OTel with caution</strong></td><td>OpenTelemetry is the best current Cowork visibility, but it is not a complete compliance audit trail. Correlate it with source-system logs.</td><td><a href="/handbook/6.-observability-audit-and-evidence/6.2-opentelemetry-for-ai-runtime-visibility.md">6.2 OpenTelemetry for AI runtime visibility</a></td></tr><tr><td><h3><i class="fa-clock" style="color:$primary;">:clock:</i></h3></td><td><strong>Constrain unattended work</strong></td><td>Scheduled tasks and persistent approvals need stricter folder, network, tool, and external-write boundaries than supervised sessions.</td><td><a href="/handbook/3.-runtime-sandbox-and-autonomy/3.6-scheduled-and-background-tasks.md">3.6 Scheduled and background tasks</a></td></tr></tbody></table>

## What is Claude Cowork?

Claude Cowork lets users delegate multi-step knowledge-work tasks to Claude. It can create documents and analyses, work across local folders, run shell commands and code, use plugins and MCP tools, browse the web, and schedule or remotely continue work.

Cowork is available through Claude Desktop, with remote sessions accessible from web and mobile. A remote session does not automatically reach the user's computer. Local file or browser access is bridged through an online Claude Desktop host and is limited to what that host exposes.

## Where Claude Cowork runs and what it can access

Cowork has two main execution paths:

* **Local sessions:** The agent loop runs on the endpoint. Code executes in a local Linux VM with mounted-folder, syscall, session, and network controls. File access is limited to folders the user shares.
* **Remote sessions:** Work runs in an isolated, temporary Anthropic-hosted environment. It cannot reach private networks or the user's device by default. Access to local folders or a browser is mediated by Claude Desktop while that device is online.

Connectors use separately stored tokens. Anthropic states that connector tokens are not placed inside the Cowork sandbox. Local MCP servers, extensions, and browser bridges can still expand the reachable systems substantially.

## Claude Cowork security boundary

The VM protects the host from ordinary file and code operations, but it is not a complete boundary for every tool.

* Claude in Chrome can read pages, click, type, download, and use authenticated browser sessions.
* Computer Use interacts with the real desktop and applications, outside the VM.
* MCP servers and plugins can expose external systems, credentials, scripts, and hooks.
* Documents, web pages, email, and tool output can contain prompt injection.
* Endpoint detection tools cannot inspect activity inside the local VM, and cannot inspect remote sessions running on Anthropic infrastructure.

Cowork is not generally Zero Data Retention eligible. Confirm the exact data terms for the deployment path, including any third-party inference provider.

## How to configure Claude Cowork securely

### Control availability

* Use the organization-wide Cowork toggle as the main enablement switch.
* On Enterprise, use custom roles and groups to limit Cowork to approved users.
* Control remote sessions separately from local desktop Cowork.
* Require trusted-device enrollment and recent sign-in for remote sessions where supported.
* Disable the ability to act without asking when the workflow does not justify persistent approval.

### Limit files, tools, and network access

* Use **allowedWorkspaceFolders** to restrict folders that can be mounted.
* Disable local MCP with **isLocalDevMcpEnabled** when it is not needed.
* Disable desktop extensions with **isDesktopExtensionEnabled** or use the extension allowlist.
* Apply a restrictive network-access policy and allow only required destinations.
* Keep Claude in Chrome disabled or on a short site allowlist during pilot rollout.
* Treat plugins as executable supply-chain dependencies. Review their skills, connectors, agents, and hooks.
* Do not grant broad shared credentials to tools that every Cowork user can invoke.

### Approvals and monitoring

* Require approval for deletion, external writes, sharing, credential use, and other high-impact actions.
* Configure Cowork OpenTelemetry for Team or Enterprise deployments that require operational visibility.
* Route telemetry to an approved collector and SIEM.
* Redact prompt text, email addresses, file paths, shell commands, tool parameters, and other sensitive fields before long-term storage.
* Do not treat OpenTelemetry as a compliance-grade audit trail. Cowork is not currently represented in audit logs, the Compliance API, or data exports.

## Claude Cowork security review checklist

* A named owner has approved the local, remote, browser, MCP, plugin, and Computer Use surfaces separately.
* Only dedicated, low-privilege folders are mounted.
* Network egress is deny-by-default or limited to approved destinations.
* Browser access is disabled or site-allowlisted.
* MCP servers and plugins have source review, credential scoping, and an update process.
* Persistent approvals are disabled for high-impact tools.
* OTel data is collected, redacted, protected, and correlated to identities.
* Regulated workflows do not depend on audit evidence Cowork cannot produce.
* Users understand prompt injection and review every external side effect.

## Claude Cowork provider documentation

* [Get started with Claude Cowork](https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork)
* [Claude Cowork architecture](https://support.claude.com/en/articles/14479288-claude-cowork-architecture-overview)
* [Use Cowork safely](https://support.claude.com/en/articles/13364135-use-claude-cowork-safely)
* [Use Cowork on web, desktop, and mobile](https://support.claude.com/en/articles/15520349-use-claude-cowork-on-web-desktop-and-mobile)
* [Monitor Cowork with OpenTelemetry](https://support.claude.com/en/articles/14477985-monitor-claude-cowork-activity-with-opentelemetry)
* [Computer Use in Cowork](https://support.claude.com/en/articles/14128542-let-claude-use-your-computer-in-cowork)
* [Enterprise configuration for Claude Desktop](https://support.claude.com/en/articles/12622667-enterprise-configuration-for-claude-desktop)

## Applicable Harmonic guidance

* [Securing Claude Cowork: A Security Practitioner's Guide](https://www.harmonic.security/resources/securing-claude-cowork-a-security-practitioners-guide)

*Last reviewed: August 18, 2026*

## Related handbook guidance

* [Anthropic](/by-ai-vendor/anthropic.md)
* [2.1 Connectors and apps: the integration backbone](/handbook/2.-supply-chain-and-extensibility/2.1-connectors-and-apps-the-integration-backbone.md)
* [3.1 What Even is an AI Sandbox?](/handbook/3.-runtime-sandbox-and-autonomy/3.1-what-even-is-an-ai-sandbox.md)
* [5.1 Prompt injection: the connective risk](/handbook/5.-threats-and-adversarial/5.1-prompt-injection-the-connective-risk.md)
* [6.2 OpenTelemetry for AI runtime visibility](/handbook/6.-observability-audit-and-evidence/6.2-opentelemetry-for-ai-runtime-visibility.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://handbook.harmonic.security/by-ai-vendor/anthropic/claude-cowork.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.