# Is Claude Cowork safe? What Anthropic documents and its limits

> Anthropic lists isolation, classifiers and approval modes for Cowork, and says the chance of an attack is still non-zero. Here is what each control covers.

URL: https://claudegpt.si/news/is-claude-cowork-safe  
Published: 2026-11-03T14:52:01.021Z  
Author: ClaudeGPT Si Newsroom  
Section: Apps  
Topics: Anthropic, Claude, Claude Cowork, AI safety, Prompt injection  
Publisher: ClaudeGPT Si

## Key takeaways

- Anthropic says Cowork can only read and write files in folders you connect, and only while the desktop app is open.
- Anthropic says isolation limits where Claude's code runs, not what Claude reads or does with the access you grant.
- Anthropic says its protections reduce risk but the chance of a prompt injection attack is still non-zero.

Anthropic does not call Claude Cowork risk-free, and neither should you. Its own safety article lists protections that reduce risk and says the chance of an attack is "still non-zero." So the answer to whether Claude Cowork is safe is that it depends on what you give it access to and how you set its approvals. This page covers what Anthropic documents in its [Help Center article on using Cowork safely](https://support.claude.com/en/articles/13364135-use-claude-cowork-safely), as of November 3, 2026.

Nothing here is a guarantee. Anthropic's pages describe controls and their limits, and we have not tested them.

## What Anthropic says Cowork can reach

Cowork runs your tasks in the cloud, according to [Anthropic's getting-started article](https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork). Code and shell commands run in an isolated environment, and the session stays on your account even if your laptop closes. Anthropic's article does not name a virtual machine or sandbox technology.

Your own computer comes in only through the Claude Desktop app. Anthropic says Claude can only read and write files in folders you have connected, and only while the app is open. The safety article adds that local files opened this way are processed on Anthropic's servers.

## Isolation limits where code runs, not what Claude does

This is the most important line in the documentation. Anthropic says isolation limits where Claude's code runs, and that it "doesn't limit what Claude reads or does" through the access you have granted. If you connect a folder, Claude can read everything in it. If you connect a mail or browser tool, Claude can act through it.

## Prompt injection is the main risk

Prompt injection means hidden instructions in an email, web page or document that try to take over the assistant. Anthropic's example is an email that tells Claude to transfer money.

Anthropic says an injection only works when Claude can both read untrusted content and take actions that could hurt you. Cutting either one lowers the risk. The page recommends avoiding sensitive local files and sites, giving internet access only to trusted sites, and using trusted MCP servers (connectors that give Claude extra tools).

Two limits are worth knowing. Anthropic says network egress permissions do not apply to the web fetch and web search tools or to MCPs. And the built-in browser and Claude in Chrome carry the same risks, so Anthropic strongly advises against using either for sensitive information.

## The protections Anthropic lists

- Claude is trained with reinforcement learning to refuse malicious instructions, including urgent-sounding ones.
- Each session gets a temporary environment that is removed afterward.
- Classifiers scan untrusted content for injections before it reaches Claude.
- In "Automatically approve" mode, each action is reviewed and unsafe ones are blocked.
- Permanent file deletion needs your explicit permission.
- With computer use, Claude asks permission before accessing each application.

## Approval modes

| Mode | What Anthropic says |
| --- | --- |
| Manually approve | Claude asks before actions and you allow or deny each one. |
| Automatically approve | Claude does not ask at each step, but every action is reviewed first and unsafe ones are blocked. |
| Skip all approvals | Claude does not pause, and nothing checks its actions automatically. Use it only when you trust everything involved. |

Anthropic suggests manual approval for sensitive files, new tools and actions that are hard to undo.

## What Anthropic recommends you do

- Use a dedicated working folder, keep credentials and financial files out of it, and keep backups.
- Watch for file or site access you did not ask for, and stop the task if something looks off.
- Start scheduled tasks with low-risk work. They run even when your computer is off.
- With computer use, block apps such as banking and healthcare portals. Clicking a link opens it even if Claude lacks permission for that app.
- Be careful with plugins and local MCP servers. Anthropic says local servers run with the same permissions as any other program you run.
- If Claude drifts to unrelated topics, reaches for unexpected resources or asks for sensitive information unprompted, stop and report it through the in-app feedback button.

You also stay responsible for what Claude does for you, including messages sent, purchases and scheduled-task actions.

## What admins can see

For Team and Enterprise, Anthropic's safety article says Cowork activity on web and mobile is captured by the Compliance API, and owners can stream Cowork events to SIEM and observability tools through OpenTelemetry. We did not find Anthropic documentation of endpoint detection (EDR) monitoring for Cowork, so we do not cover it here.

For how Cowork compares with Anthropic's coding agent, see [Claude Code vs Cowork](https://claudegpt.si/news/claude-code-vs-cowork). Anthropic's pages are updated often, so check the safety article before you connect anything sensitive.

## Frequently asked questions

### Can Claude Cowork read all my files?

According to Anthropic, Claude can only read and write files in folders you have connected, and only while the Claude Desktop app is open. Anything inside a connected folder is within reach.

### Does Cowork run in a sandbox?

Anthropic says code and shell commands run in an isolated, temporary environment in the cloud. It also says this isolation does not change what Claude can read or do through the access you grant.

### What is the safest approval mode in Cowork?

Manually approve asks before each action. Anthropic suggests it for sensitive files, new tools and hard-to-undo actions. Skip all approvals means nothing checks Claude's actions automatically.

### Can Cowork be hit by prompt injection?

Yes. Anthropic says hidden instructions in emails, sites or documents can try to hijack Claude, and that its protections reduce but do not remove that risk.

## Sources

- [Use Claude Cowork safely](https://support.claude.com/en/articles/13364135-use-claude-cowork-safely), Anthropic Help Center
- [Get started with Claude Cowork](https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork), Anthropic Help Center