Last verified against Anthropic's documentation on July 11, 2026. Claude Cowork is changing fast, and parts of it are still in beta. If you are reading this months from now, check the linked sources.
You are about to hand an AI agent a folder full of your business. Invoices. Client files. The spreadsheet that runs your whole operation.
The question is not "is this cool." You already know it's cool. The question is the one you ask at 11pm with your finger over the Connect button: what actually leaves my machine?
Here is the honest answer, pulled from Anthropic's own documentation this week, including the parts that are less comfortable than the marketing.
The short answer, updated for July 2026
More leaves your machine than most people think, and Anthropic tells you so if you read the architecture doc.
Until recently, the mental model everyone had was: Cowork runs on your laptop, in a little sandbox, and your files stay put. That model is now out of date.
As of Anthropic's current architecture overview, Cowork sessions run remotely by default. The agent loop and the code execution happen on Anthropic's servers, not on your computer. Local execution still exists, but it is now described as remaining "available for existing desktop deployments."
The practical consequence is stated plainly by Anthropic: when a remote session opens your local files through the desktop app, that work "is processed on Anthropic's servers rather than staying on the device."
So: your files can leave your machine. They go to an isolated, temporary environment that Anthropic runs, and Anthropic has built a fairly serious set of walls around that environment. Whether that is fine depends on what is in the folder, and we will get to how to decide.
What does not leave your machine is worth saying too, because it is the thing people fear most and it is genuinely well handled: your connector passwords and authorization tokens never enter the sandbox at all. Anthropic makes those calls server-side and hands the sandbox only short-lived, session-scoped tokens.
What Anthropic actually built
Give credit where it is due. This is not a thin wrapper.
For remote sessions, per the architecture overview:
- Every session gets its own sandbox. It is created when the session starts and destroyed when it ends.
- Sandboxes do not share state with each other or across organizations.
- That infrastructure is kept separate from Anthropic's corporate, research, and model-training environments.
- The sandbox cannot reach private, internal, link-local, or cloud-metadata addresses, and it cannot reach Anthropic's own internal systems. In plain terms, it cannot be used to pivot into your network.
- All traffic leaving the sandbox goes through a mandatory proxy that the sandbox cannot reconfigure or bypass. Only allow-listed destinations are reachable.
- The sandbox holds only session-scoped tokens that expire within hours. Connector authorization tokens never enter it.
For local sessions, the code Claude writes runs inside a dedicated Linux virtual machine, isolated from your operating system by the platform's hypervisor: Apple's Virtualization.framework on macOS, Hyper-V on Windows. That VM enforces its own network egress filtering, syscall restrictions, and per-session user isolation.
And in both modes, file access is scoped: Claude can only read and write in the folders you explicitly connect.
That is a real security architecture. If you were worried that "AI agent on my computer" meant a script with root, it does not.
The sentence that should actually shape your setup
Here is the line, from Anthropic's own safety guidance, that matters more than every bullet above:
"Isolation limits where Claude's code runs. It doesn't limit what Claude reads or does."
Read that twice.
The sandbox is a wall around the execution. It is not a wall around the access you granted. If you connect a folder, Claude can read everything in that folder. If you connect an email account, Claude can act in that email account. The VM does not save you from a decision you made in the permissions dialog.
Anthropic is refreshingly direct about the other limits too:
- Computer use has no sandbox. In their words, "computer use has no sandbox between Claude and what's on your screen." File operations go through permission checks and code runs in an isolated environment. Watching and clicking your screen does neither.
- Prompt injection risk is not zero. Anthropic trains Claude to refuse malicious instructions and runs classifiers over untrusted content, and then says: "the chances of an attack are still non-zero. Always exercise caution when using Cowork."
- Network egress permissions do not cover everything. They do not apply to web fetch, web search, or MCP tools, including Claude in Chrome.
- You are on the hook. "You remain responsible for all actions taken by Claude performed on your behalf." That explicitly includes purchases, financial transactions, and anything a scheduled task does while you are asleep.
A vendor that publishes its own failure modes is a vendor worth trusting more, not less. But you have to actually act on what they published.
The six settings that decide your risk
This is the part to steal. None of it requires you to understand hypervisors.
1. Treat a connected folder as a fully read folder. Not "Claude might look at this." Assume it read all of it. So do not connect your Desktop. Do not connect your whole Documents folder. Make a working folder, put in it exactly what the job needs, and connect that.
2. Know which permission mode you are in. There are three: Manually approve, Automatically approve, and Skip all approvals. Manual asks you before each action. Auto reviews each action for safety, including checking for prompt injection, and blocks what it judges unsafe. Skip does what it says.
3. Know what Auto mode will still stop for. This is the reassuring detail nobody quotes. Even in Auto, Claude will not self-approve the sensitive stuff. Anthropic lists it: granting access to additional folders, deleting files in a folder it already has access to, and creating scheduled tasks. Auto is not a blank cheque.
4. Deletion always prompts. In every mode. Claude asks before it permanently deletes files, full stop. If you see that prompt and you did not expect it, stop and read it.
5. Be careful what you schedule. Anthropic's own advice, and it is good advice: "Don't schedule tasks that access sensitive files, send messages on your behalf, make purchases, or take other actions that are difficult to undo." An unattended agent with your outbox is a category of regret. Schedule the reporting. Do not schedule the sending.
6. Vet plugins like software, because they are. Local MCP servers bundled with plugins run on your computer "with the same permissions as any other program you run." Installing a plugin can meaningfully widen what Claude can touch. Stick to verified extensions and read what they ask for.
What we do, running a store through it
We are not theorizing. We run a Shopify store with nearly a hundred and growing self-install kits, and the store's operations run through Cowork. So here is our actual posture, offered as one operator's setup rather than as advice from on high.
We connect scoped working folders, never a home directory. We run Manual mode for anything that touches money or a customer, and Auto for research and drafting. Nothing that sends an email or changes a price runs unattended on a schedule. And every claim we make about the product, including in this article, gets pulled from primary documentation on the day we publish, because the product has changed materially twice in the last month.
That last habit is the whole discipline in miniature. The risk with an AI agent is almost never the sandbox. It is the gap between what you think you granted and what you actually granted.
Compliance, briefly, for anyone who has to answer to someone
Anthropic's certifications page lists SOC 2 Type I and Type II, ISO 27001:2022, ISO/IEC 42001:2023, and a HIPAA-ready configuration available with a BAA.
Two gaps worth knowing before you tell your compliance lead this is handled:
- Cowork activity is not currently captured in audit logs, the Compliance API, or data exports. Anthropic says so directly.
- Endpoint detection tools cannot see inside the VM. Your EDR is blind to what happens in there.
If you are a solo operator, neither of those will keep you up at night. If you have an IT function, they will want to know both.
So, is it safe enough for your business?
For most solo operators and small teams doing the work around the work, which is to say invoices, reporting, content, research, and admin: yes, with a scoped folder and Manual mode on anything consequential.
The honest framing is not "it's sandboxed, relax." It is: this is a powerful tool with real walls and real, published limits, and the security of your setup is mostly a function of what you connect and what you let run unattended.
That is a much better position to be in than trusting a vendor who claims there are no limits at all.
Start here: if you want to see what a properly scoped, single-purpose automation actually looks like before you hand an agent anything sensitive, our kits are each built to do exactly one job with the narrowest access that job requires. Browse the kits by what you are trying to fix.
Or start smaller: The Automation Playbook walks through finding the first task worth handing to an AI, and how to scope it so it can't reach anything it shouldn't. Free.
Sources, all verified 2026-07-11: Anthropic's Claude Cowork architecture overview, Use Claude Cowork safely, Get started with Claude Cowork, and the Anthropic certifications page. We are not affiliated with Anthropic. Claude and Claude Cowork are Anthropic's products; we build install kits that run inside them.
Frequently asked questions
Does Claude Cowork upload my files to the cloud?
It can, and by default it now does. Cowork sessions run remotely by default, meaning the agent loop and code execution run on Anthropic's servers. Local files opened through the desktop app during a remote session are processed on Anthropic's servers rather than staying on your device. The sandbox is isolated, temporary, and destroyed when the session ends.
Can Claude Cowork see files I did not give it?
No. Claude can only read and write in folders you explicitly connect, and each local tool call is checked against your permissions before it runs. The practical risk is not unauthorized access, it is over-generous authorization: if you connect a broad folder, everything in it is in scope.
Will Claude Cowork delete my files?
Not without asking. Claude requires explicit permission before permanently deleting any files, in every permission mode, including Auto. You will see a prompt and have to allow it.
Is Auto mode safe to leave on?
Auto mode reviews each action for safety, including prompt-injection checks, and blocks what it judges unsafe. It also will not self-approve sensitive actions such as granting access to new folders, deleting files, or creating scheduled tasks. It consumes more of your usage than the other modes. For anything touching money or customers, Manual is the safer default.
Can Claude Cowork be tricked by a malicious document?
Anthropic trains Claude to refuse malicious instructions and runs classifiers over untrusted content entering its context, and states plainly that the chance of an attack is still non-zero. Treat any file, webpage, or email from an untrusted source as untrusted input, and do not run it in Skip-all-approvals mode.