Claude AI security: what Anthropic's controls cover and what your team still sets

Claude Cowork security, as Anthropic's help article describes it, starts with where the work runs. The article says "Cowork sessions run in the cloud on Anthropic's servers" and that Claude's work runs in an isolated, temporary environment that can't reach your home or company network and is removed when the session ends.

The same article is direct about the limit of that isolation: "Isolation limits where Claude's code runs. It doesn't limit what Claude reads or does." If you connect folders, apps or the web, Claude can use them, so what you connect is the real boundary.

Anthropic lists multiple layers of protection, including reinforcement learning to train Claude to recognize and refuse malicious instructions, scanning of untrusted content that enters Claude's context to flag potential injections, and, in "Automatically approve" mode, a review of each action before it runs. The article also says Cowork requires your explicit permission before permanently deleting any files, and that when Claude uses your computer it asks permission before accessing each application.

On residual risk the article says "the chances of an attack are still non-zero." Its advice includes a dedicated working folder instead of broad access, starting with lower-stakes tasks, and using "Manually approve" when a task touches sensitive files, accounts or sites.

Anthropic's Claude Code page defines it as a technique where an attacker attempts to override or manipulate an AI assistant's instructions by inserting malicious text. Examples include a web page, a document or an email Claude reads. The page also lists safeguards, including approval for network commands such as curl and wget and a separate model call that summarizes fetched web pages so Claude does not see the raw page for most fetches.

Anthropic's pages are candid that these safeguards reduce risk and do not remove it. The Claude Code page says: "no system is completely immune to all attacks." Treat any content from outside your organization as untrusted, and keep approval prompts on for actions that send data out or change systems of record.

Which Claude products will staff use, and on which plan? The controls differ for chat, Claude Code and Cowork.

Which folders, apps and accounts can Claude reach? Is each one needed for the task?

Which approval mode is the default, and who may change it? Is Auto mode allowed for your organization?

Is sandboxing on for Claude Code, and is there a restriction on network access?

Which connectors and MCP servers are approved, and who reviews new ones?

What stays out of Claude entirely, such as credentials or regulated records, and how is that enforced rather than just written in a policy?

Where are usage and actions logged, and who looks at the logs?

What do staff do when something looks wrong? Anthropic's advice for Cowork is to stop the task immediately.

Kriv AI has achieved the Select partner tier in the Claude Partner Network Services Track. We help teams plan and configure Claude rollouts, including permission settings, connector review, approval rules and staff training, with work informed by Anthropic's published security documentation. We do not give legal advice and this page is not a security audit of your environment. Engagements are scoped and priced after a short discovery call.