Securing Claude Cowork: A Security Practitioner’s Guide

Claude Cowork gives employees a local AI agent that can write code, browse the web, manage files, and run scheduled tasks — all on their machine. That's a meaningfully different threat surface than a chatbot.

You can't eliminate the risk, but you can control it. This guide covers what security teams need to know and maps relevant controls to NIST CSF and AI RMF so you can act quickly.

Note: Cowork is in research preview and the control landscape is evolving. We'll update this guide as capabilities and admin options change.

‍
Last updated: March 9th 2026

‍
‍

1. TL;DR: The 9 Things That Matter

‍

If you read nothing else, know these nine things before enabling Claude Cowork for your organization.

‍

1. Cowork is not a chatbot. It runs code in a VM on the user’s machine, reads/writes local files, browses the web with the user’s session cookies, and can execute scheduled tasks unattended.

2. OpenTelemetry is your best current visibility tool but it's imperfect. It provides usage metrics, cost data, and tool activity. It lacks some capabilities that you might expect from the Compliance API, but it is possible to track usage. Route it to your SIEM immediately. Cowork activity is explicitly excluded from all three: Audit Logs, Compliance API, and Data Exports.

3. Prompt injection is the #1 risk. Anthropic self-reports ~1% attack success rate on Claude in Chrome even after mitigations. Hidden instructions in web pages, emails, or documents can hijack Claude’s actions.

4. Chrome is high-risk. Claude in Chrome screenshots your active tab, clicks buttons, fills forms, and executes JavaScript. Default blocked categories: financial services, banking, investment platforms, crypto exchanges, adult content, pirated content. Healthcare and internal tools are NOT blocked by default.

5. Conversation history is local-only. Stored on the user’s machine. Not subject to Anthropic’s retention policies. Cannot be centrally managed or exported by admins.

6. Plugins are powerful and risky. Each plugin bundles skills, slash commands, sub-agents, and MCP servers. Installing one significantly expands Claude’s scope of action. Treat them like software dependencies.

7. MCP servers run with system-level access. Local MCP servers (stdio transport) may have excessive access to the machine. Remote servers (HTTP/SSE) require authentication but introduce network attack surface. Known supply chain CVEs exist (CVE-2025-59536, CVE-2026-21852).

8. Scheduled tasks run unattended. They execute while the desktop app is open but the user may not be watching. A prompt injection loop in a scheduled task could run for hours.

9. The admin toggle is all-or-nothing. Cowork access cannot be limited by user or role during the research preview. It’s organization-wide: everyone has access or no one does.

‍

‍

2. Pick Your Posture

Not every organization needs the same level of enablement. Based on conversations with security teams deploying Cowork today, we see three postures. Find yours and use it to scope the rest of this guide.

‍

‍

‍

2.1 Lockdown: “We’re Not Enabling Cowork Yet”

This is a valid and common posture during the research preview. But “not enabling” doesn’t mean “nothing to do.” You still need to actively prevent shadow usage and prepare for when your organization is ready.

‍

What to do right now (even if Cowork stays off)

☐ Toggle Cowork OFF: Admin Settings > Capabilities > Cowork. Do this explicitly; on Team plans it may default to on

‍

☐ Disable Claude in Chrome: Admin Settings > Claude in Chrome toggle, and/or Admin Settings > Connectors > Claude in Chrome > Toggle off

Prevent account switching and shadow AI (Enterprise only)

Tenant restrictions are your primary defense against employees bypassing managed controls by using personal Claude accounts. Without them, a user on your corporate network can simply switch to a personal account where Cowork, Chrome, and all plugins are fully enabled with no admin oversight.

☐ Configure tenant restrictions by having your network proxy inject the anthropic-allowed-org-ids HTTP header into all requests to claude.ai and api.anthropic.com

☐ Find your Organization UUID in Settings > Account or Admin Settings > Organization (scroll to bottom)

☐ Header format: anthropic-allowed-org-ids: <your-org-uuid> (comma-delimited for multiple orgs, no spaces)

☐ TLS inspection is required for the proxy to inject headers into HTTPS traffic

This covers web access (claude.ai), the desktop app, and API authentication. Supported proxy platforms include Zscaler ZIA, Palo Alto Prisma Access, Cato Networks, Netskope, and any HTTPS proxy with header injection.

When blocked, users see: “Access restricted by network policy. Contact IT Administrator.” with error code tenant_restriction_violation.

☐ Test by making an API call from the restricted network with your org’s key to verify the header is being injected and validated

‍

⛔ Without tenant restrictions, your admin toggles are a suggestion, not a control. A user can switch to a personal Pro/Max account on the same machine and bypass every organizational guardrail you’ve configured. This is Enterprise-only. Team plans cannot enforce tenant restrictions.

‍

Other Lockdown actions

☐ Communicate to your org: “Cowork is not approved for use. It is disabled. If you need agentic AI capabilities, here is the process for requesting access.”

☐ Monitor: even with Cowork off, users may have personal Claude accounts. Your DLP and CASB should be watching for claude.ai traffic on non-managed accounts

☐ Team plan without tenant restrictions: consider blocking claude.ai at the proxy level entirely, or use Chrome enterprise policies (GPO/MDM) to prevent the Claude in Chrome extension from being installed on managed browsers

☐ Enable OpenTelemetry anyway. It gives you baseline visibility into Chat and Code usage that you’ll want when you eventually evaluate Cowork

☐ Track Anthropic’s roadmap. The key blocker for most regulated orgs is the audit log gap. When Cowork activity is captured in the Compliance API, re-evaluate
‍

⚠ The defaults matter. On Team plans, both Cowork and Claude in Chrome are enabled by default. If you’re on a Team plan and haven’t explicitly disabled these, your users may already have access.

‍

2.2 Controlled: “Enable with Guardrails”

This is the posture most Enterprise and mature Team organizations should target. Cowork is on, but the browser, plugins, MCP servers, and connectors are tightly scoped. The second responder in the CISO thread above describes exactly this: “default sandbox blocks most network access, not allowed browser plugin, allowlisted MCP centrally.”

‍

The minimum viable secure configuration

☐ Cowork ON, Chrome extension OFF (or strict allowlist of 5-10 trusted domains)

☐ Network egress: keep defaults. The sandbox blocks most outbound traffic already. Only allowlist domains you’ve tested

☐ MCP servers: centrally allowlisted via managed-mcp.json deployed through MDM (Jamf, Intune). Users cannot add their own

☐ Connectors: admin-approved only. Prefer read-only connectors. Disable write-access connectors (send_email, post_message) unless explicitly justified

☐ Scheduled tasks: permitted but restricted to read-only tasks (summaries, reports). No tasks that send messages, make purchases, or modify external systems

☐ Global instructions: add defensive prompts (see Section 6 for recommended text)

☐ OpenTelemetry: enabled and routed to SIEM with alerting for anomalies

☐ User training: mandatory before access. Cover prompt injection, folder hygiene, incident reporting

‍

This posture gives you meaningful value from Cowork (file processing, document generation, research synthesis, data analysis) while cutting off the highest-risk attack surfaces (browser, unvetted MCP servers, uncontrolled plugins).

‍

2.3 Open: “Full Enablement with Policy”

Appropriate for innovation teams, low-sensitivity workloads, or organizations with high risk tolerance. Browser is enabled, plugins are broadly available, and users have more autonomy. Controls shift from prevention to detection and response.

‍

Key controls for the Open posture

☐ Chrome: enabled with a blocklist covering financial services, healthcare, cloud consoles, and internal admin tools. Users can access other sites

☐ Plugins: marketplace available, users can self-install. Org-level plugins auto-installed for consistency

☐ MCP servers: allowlist at org level, but users can request additions through a lightweight review process

☐ Scheduled tasks: user discretion within the acceptable use policy. Regular audit of active tasks

☐ Monitoring: OTel to SIEM with real-time alerting. Weekly review of connector usage and scheduled task patterns

☐ Incident response: users trained to stop suspicious tasks immediately. Clear escalation path documented

‍

⚠ Even in the Open posture, the audit log gap means you cannot use Cowork for regulated workloads. This posture works for productivity and knowledge work, not compliance-sensitive processing.

‍

3. What the Defaults Actually Do

Cowork’s out-of-the-box defaults are more restrictive than you might expect. But those defaults vary by plan. Understanding what’s already locked down on YOUR tier helps you focus your hardening effort on the real gaps.

‍

‍

ℹ Bottom line: Enterprise gets the best defaults (Chrome off, no-training, admin controls available). Team gets admin controls but worse defaults (Chrome on, Cowork on). Pro/Max users have no admin controls at all. Your hardening work scales inversely with your plan tier.

‍

4. Key Considerations

This section covers the essential decisions and controls for each attack surface. Use it as your planning guide before diving into the detailed checklist in Section 6.

‍

4.1 Plan Tier Determines Your Controls

Your Anthropic subscription tier dictates what security controls you can actually enforce. The gap between Enterprise and Pro/Max is significant.

‍

‍

‍

⚠ Enterprise: Chrome is disabled by default. Team: Chrome is enabled by default. This means Team admins must act immediately to configure or disable Chrome on enablement.

‍

4.2 The Audit Gap

The Compliance API (Enterprise-only, NDA required via Trust Center) provides programmatic access to activity logs, chat histories, and file content for Chat and Claude Code. It now includes audit log events. However, Cowork activity is explicitly excluded from all three: Audit Logs, Compliance API, and Data Exports.

OpenTelemetry is your best current visibility tool for Claude Cowork. It provides usage metrics, cost data, and tool activity via the Claude Agent SDK's OTel events schema. If your organization is moving quickly on Cowork adoption, getting this routed to your SIEM should be an early priority.

That said, it's not plug-and-play. Standing it up requires owning the infrastructure yourself:

• You need a running OTel-compatible endpoint or receiver to collect events
• Environment variables must be configured for both collection and privacy controls
• Monitoring must be enabled in Claude admin settings

On privacy: user prompt content is not collected by default and only prompt length is recorded. To include prompt content, set OTEL_LOG_USER_PROMPTS=1. Raw file contents and code snippets are never included in metrics or events.

One thing to watch: tool execution events include bash commands and file paths in the tool_parameters field, which may contain sensitive values. If your commands could include secrets or credentials, configure your telemetry backend to filter or redact tool_parameters before the data lands in your SIEM.

Of course, this is not a compliance-grade audit trail. Until Anthropic closes this gap, do not use Cowork for any workflow that requires an audit trail for regulatory compliance.

‍

‍

4.3 Browser Automation: Know What’s Blocked

Claude in Chrome blocks the following site categories by default: financial services, banking, investment platforms, cryptocurrency exchanges, adult content, and pirated content. Anthropic acknowledges this list may not be exhaustive. The following are NOT blocked by default and should be added to your org blocklist:

☐ Healthcare portals (Epic MyChart, patient systems)

☐ Password managers (1Password, LastPass, Bitwarden web vaults)

☐ Cloud consoles (AWS, GCP, Azure portals)

☐ HR, payroll, and benefits systems

☐ SSO admin panels and identity provider dashboards

☐ Internal wikis and knowledge bases with restricted content

☐ Email with confidential data (if not already scoped via allowlist)

Enterprise admins can also disable the Chrome-to-Cowork bridge specifically by toggling off the Claude in Chrome connector in Admin Settings > Connectors.

‍

4.4 MCP and Plugin Supply Chain

MCP servers are the integration backbone. Local servers (stdio transport) run on the user’s machine with full system access. Remote servers (HTTP/SSE) communicate over the network and require authentication. Both are attack surfaces.

Real-world supply chain attacks have been demonstrated. CVE-2025-59536 (CVSS 8.7, patched October 2025) allowed RCE via malicious hooks and MCP configs in .claude/settings.json, executing commands before the trust dialog appeared. CVE-2026-21852 (CVSS 5.3, patched January 2026) allowed API key exfiltration via ANTHROPIC_BASE_URL override. Both were triggered simply by opening an untrusted repository.

Treat every MCP server like a software dependency. Maintain an allowlist. Review source code. Use scoped, short-lived credentials for authentication.

‍

4.5 Data Residency and Retention

Anthropic processes data in the US, Europe, Asia, and Australia by default. Data at rest is stored in the US. Regional inference endpoints (guaranteeing processing stays in a specific region) are available via AWS Bedrock, GCP Vertex AI, and Microsoft Foundry, not as a native plan feature. For regulated workloads requiring regional data residency, deploy via these cloud providers.

Cowork conversation history is stored locally on the user’s machine and is not governed by Anthropic’s retention policies. This means your endpoint security posture (full-disk encryption, EDR, patch management) is your data protection layer for Cowork sessions.

‍

5. Threat Model for Agentic Desktop AI

Cowork’s threat model is fundamentally different from Chat. The attack surface includes every data source Claude touches, every tool it can call, and every action it can take autonomously.

‍

5.1 Prompt Injection (Highest Risk)

Indirect prompt injection is the primary threat. Malicious instructions hidden in documents, web pages, emails, or calendar events can hijack Claude’s behavior. Because Cowork can act (write files, browse, execute code), a successful injection has real consequences beyond text output.

Attack surface by integration:

☐ Chrome: any web page Claude visits can contain hidden instructions. ~1% success rate per Anthropic’s testing

☐ Local files: a document in the working folder could contain injected instructions

☐ MCP servers: a compromised server can return poisoned tool results

☐ Connectors: data from external services (email, calendar, Slack) may contain injections

☐ Cross-app flow: data moves between Excel, PowerPoint, Chrome, and local files within a session

‍

5.2 Supply Chain Attacks

Configuration files are now an attack surface. CVE-2025-59536 demonstrated that .claude/settings.json and .mcp.json files in cloned repositories can execute arbitrary code before the user sees a trust dialog. Plugins sourced from public marketplaces or GitHub repos carry similar risk.

Mitigations: use private plugin marketplaces, vet all plugin source code, enforce branch protection on plugin repos, and keep Claude Desktop updated (both CVEs are patched).

5.3 Data Exfiltration

Cowork can exfiltrate data through multiple channels: MCP server network calls, Chrome browser actions, file writes to external paths, or API calls to external endpoints. The PromptArmor demonstration showed that a model can be tricked into uploading documents via cURL to an attacker’s endpoint. Because anthropic.com is typically on the network egress allowlist, exfiltration to Anthropic’s own API is difficult to block.

5.4 Unattended Execution

Scheduled tasks run without real-time human oversight. A prompt injection that takes hold during a scheduled task has no human to stop it. Compound this with Chrome access and the risk of an automated, recurring prompt injection attack becomes real.

‍

6. Deployment Checklist

Three phases: prepare your environment, configure on day of rollout, and maintain ongoing operations.

‍

‍

‍

7. Control Mapping

Reference table for integrating Cowork controls into your existing governance framework.

‍

NIST CSF 2.0

‍

‍

NIST AI RMF

‍

‍

‍